Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 00:16
Static task
static1
Behavioral task
behavioral1
Sample
4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe
-
Size
701KB
-
MD5
4f5fbb2c69b296d3ea4fb04435cbd900
-
SHA1
f32cbf159df1bfdd20990c93a43c66e6a807b2c0
-
SHA256
fd7f711ff05220509dc80eb9676fc84bde6db70b6421dcc572b5177fd36f4652
-
SHA512
adc62e96f640dd91073f37dba32ed3a6d0bec3c4fd698e3d3c7f6315291a12d4e6d8650ce98fec4ed9c6116692a22eeee287ee68f9b3fb9b4937cefee33ffa89
-
SSDEEP
12288:Zdj3F1uzouASA98z3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOo8:2FASz1N3RUDHNmdPCAaq8Nozgi/rE0TY
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
alg.exeaspnet_state.exemscorsvw.exemscorsvw.exeelevation_service.exeGROOVE.EXEmaintenanceservice.exeOSE.EXEOSPPSVC.EXEmscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedllhost.exeehRecvr.exeehsched.exeIEEtwCollector.exemsdtc.exemsiexec.exeperfhost.exelocator.exesnmptrap.exevds.exevssvc.exewbengine.exeWmiApSrv.exewmpnetwk.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid Process 476 2348 alg.exe 2096 aspnet_state.exe 2688 mscorsvw.exe 2692 mscorsvw.exe 2836 elevation_service.exe 2888 GROOVE.EXE 1980 maintenanceservice.exe 1272 OSE.EXE 2040 OSPPSVC.EXE 3044 mscorsvw.exe 2092 mscorsvw.exe 2744 mscorsvw.exe 2584 mscorsvw.exe 1868 mscorsvw.exe 1276 mscorsvw.exe 2084 mscorsvw.exe 1284 mscorsvw.exe 1864 mscorsvw.exe 880 mscorsvw.exe 2960 mscorsvw.exe 1304 mscorsvw.exe 1816 mscorsvw.exe 2288 mscorsvw.exe 2260 mscorsvw.exe 2876 mscorsvw.exe 3052 mscorsvw.exe 2272 mscorsvw.exe 1260 mscorsvw.exe 1992 mscorsvw.exe 2620 mscorsvw.exe 2124 mscorsvw.exe 1472 mscorsvw.exe 992 mscorsvw.exe 2008 mscorsvw.exe 2664 mscorsvw.exe 3004 mscorsvw.exe 2560 dllhost.exe 2452 ehRecvr.exe 780 ehsched.exe 2620 IEEtwCollector.exe 2124 msdtc.exe 2972 msiexec.exe 316 perfhost.exe 2360 locator.exe 1508 snmptrap.exe 2268 vds.exe 2624 vssvc.exe 2696 wbengine.exe 1524 WmiApSrv.exe 2944 wmpnetwk.exe 1760 SearchIndexer.exe 2260 mscorsvw.exe 1676 mscorsvw.exe 2136 mscorsvw.exe 2960 mscorsvw.exe 868 mscorsvw.exe 2416 mscorsvw.exe 2312 mscorsvw.exe 3012 mscorsvw.exe 2596 mscorsvw.exe 3060 mscorsvw.exe 1956 mscorsvw.exe 1312 mscorsvw.exe -
Loads dropped DLL 57 IoCs
Processes:
msiexec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid Process 476 476 476 476 476 476 476 476 2972 msiexec.exe 476 476 476 476 476 768 868 mscorsvw.exe 868 mscorsvw.exe 2312 mscorsvw.exe 2312 mscorsvw.exe 2596 mscorsvw.exe 2596 mscorsvw.exe 1956 mscorsvw.exe 1956 mscorsvw.exe 2580 mscorsvw.exe 2580 mscorsvw.exe 2572 mscorsvw.exe 2572 mscorsvw.exe 2548 mscorsvw.exe 2548 mscorsvw.exe 2920 mscorsvw.exe 2920 mscorsvw.exe 3012 mscorsvw.exe 3012 mscorsvw.exe 1276 mscorsvw.exe 1276 mscorsvw.exe 676 mscorsvw.exe 676 mscorsvw.exe 1316 mscorsvw.exe 1316 mscorsvw.exe 1992 mscorsvw.exe 1992 mscorsvw.exe 1680 mscorsvw.exe 1680 mscorsvw.exe 1100 mscorsvw.exe 1100 mscorsvw.exe 1964 mscorsvw.exe 1964 mscorsvw.exe 2292 mscorsvw.exe 2292 mscorsvw.exe 2776 mscorsvw.exe 2776 mscorsvw.exe 1316 mscorsvw.exe 1316 mscorsvw.exe 2440 mscorsvw.exe 2440 mscorsvw.exe 2920 mscorsvw.exe 2920 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 20 IoCs
Processes:
aspnet_state.exemscorsvw.exeSearchProtocolHost.exe4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exemsdtc.exealg.exeGROOVE.EXEdescription ioc Process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe aspnet_state.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe mscorsvw.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbengine.exe aspnet_state.exe File opened for modification C:\Windows\system32\vssvc.exe aspnet_state.exe File opened for modification C:\Windows\System32\snmptrap.exe aspnet_state.exe File opened for modification C:\Windows\System32\vds.exe aspnet_state.exe File opened for modification C:\Windows\System32\msdtc.exe aspnet_state.exe File opened for modification C:\Windows\SysWow64\perfhost.exe aspnet_state.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\fxssvc.exe mscorsvw.exe File opened for modification C:\Windows\System32\alg.exe 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\dllhost.exe aspnet_state.exe File opened for modification C:\Windows\system32\msiexec.exe aspnet_state.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe aspnet_state.exe File opened for modification C:\Windows\system32\SearchIndexer.exe aspnet_state.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\34dfb8a943e3c333.bin alg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE -
Drops file in Program Files directory 64 IoCs
Processes:
aspnet_state.exemscorsvw.exealg.exedescription ioc Process File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe aspnet_state.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe mscorsvw.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe aspnet_state.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe mscorsvw.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe aspnet_state.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe aspnet_state.exe -
Drops file in Windows directory 64 IoCs
Processes:
mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemsdtc.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exealg.exemscorsvw.exedescription ioc Process File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat mscorsvw.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPB867.tmp\ehiVidCtl.dll mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPBBA1.tmp\stdole.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPC311.tmp\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8C19.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPBC1E.tmp\ehiActivScp.dll mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe alg.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7D0C.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchProtocolHost.exeSearchIndexer.exeSearchFilterHost.exemscorsvw.exeehRec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeOSPPSVC.EXEdescription ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10056 = "Hearts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101 = "Windows PowerShell ISE" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000305c101127bdda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\FXSRESM.dll,-115 = "Send and receive faxes or scan pictures and documents." SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10310 = "The aim of the game in Spider Solitaire is to remove cards from play in the fewest moves possible. Line up runs of cards from king through ace, in the same suit, to remove them." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-308 = "Landscapes" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000705f621227bdda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10060 = "Solitaire" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\Windows Journal\Journal.exe,-3075 = "Create notes in your own handwriting. You can leave your notes in ink and search your handwriting or convert your notes to typed text." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\TipTsf.dll,-60 = "Enter text by using handwriting or a touch keyboard instead of a standard keyboard. You can use the writing pad or the character pad to convert your handwriting into typed text or the touch keyboard to enter characters." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\Windows Sidebar\sidebar.exe,-1012 = "Add Desktop Gadgets that display personalized slideshows, news feeds, and other customized information." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\System\wab32res.dll,-4602 = "Contact file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 OSPPSVC.EXE Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\DVD Maker\DVDMaker.exe,-63385 = "Burn pictures and video to DVD." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\OobeFldr.dll,-33057 = "Learn about Windows features and start using them." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505 = "Sticky Notes" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-104 = "Jellyfish" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe -
Modifies registry class 29 IoCs
Processes:
4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09271\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000005a4b044390349e563b3d8627d49564071ab66012d64953f0285dc7e189308173000000000e8000000002000020000000a712967f3784af4ae01ea8523a8a8744872ef9c57b7ac82c589150ff3f31db07f0000000cd57151a8810e8ff03a50d35b04a20e11e2d8707e9c3d8067ebb0372be6b53400f5818e0192823720704e5380d27e6fdbf9a28e16d7cc041c131b07141ec825e5a8d7da92fee19c824bcaa5ef140e8d94a1a4b9d53a98b5e3f8f02395854adcc53759cc1077e7b4cf0afba845b6e341a7b66d9fc9c0fb593b7d75b78691ad80c6cef889908a3bb57feb8895b44ad744a802ddc426264330901d23460cfdd65fee726c53a1ebe1e2513bcab8bdd9d56061709deb92c8f51e1b271b0d14a2b144f6a165bb861ddbf51177676296a8bbe1d2a33b78e07281701a38e60528aade46b21af484811ed20f2587ee40986a6633a4000000033f213281f5657db70553c7116daf90e1fabfdc6b280c4a4a613233f8329161b8f1f37d711cfe591cfff05c2edf0e4715d9870c3b9263bad4a8c5adca55edf6d 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09263\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b0400000002000000000010660000000100002000000012a78f0be709c1bc7dfae11ef27b789cfa261b527f8eb9d1c3af38814b938392000000000e8000000002000020000000940e0f5172a77a1abaca864fe001f26e7c2b28c6d33151cb607f64d430823e05f0000000cf8cf43ab26655388b894e3f1a14a7f150de81dfe3240cc4416c09c07b74f403a63cbca555598ea31128303aa43217be39c580600fbb95571b3ca9343fb18977c4cddcb5a1d7d60fcfc27629a15bc7c7de4e2933e0fb8f00def0009163be30a84baa39890bb415e6fc238a3259486cad59597069f264ef8c94bb41d70e1a6d1d360fa77449e33dc28f6a7f0579330d1c3dee8f1203552524ef9aa4b73e4c040cbdcf74d8c9a30539e27151ca7a7531dbdb52508297f38f0722db10d6d5eff07de01a72ef3748c08a82fe02faa6c5dc9cdda6450290b4413fdb0a2c09a6af81a6c4220d1795ded000a3707da86bf24be1400000005ad45e4c9abaf0950278b8343b16393c99e52407ce00899374bceefff3f1ecc84ad6d57d19718652911b8853818e6d89f6a402cf8cda0ec9f6590a8382742132 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09280 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09264\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000002b5af32bec013903a76ff93ab3bf79d68437dd02f602846f9088e49b44e77b55000000000e80000000020000200000005c6f2f19bdeb168ce924a3909c00b3f1038aaef94c4ea1406fe0a7a69fc8b200f0000000858712e6f701adea90a1af30362aaf950ed3afd45ad67a23eaa49a117ca1441f3fd7044f63725931c1de86f01a8d604cb58ab3a536d2bcd4ff7df5cf90daa62ba7a0d4838c4cd0c5bef9315697defcc15340c962ed3f8fd7c1525a3f0440e398cfbfd1ebe12ef73c417be4e0f162281291dffac9c0ea430451625d9a0abf1b0c66bbcfe47a86e8f3b6a5361287a767b2a5545e924c349661548e86a2d3660a82be9c4472338042496ae3448da4e5cd63a54744c8f08e5b2c6637527e7b2676b76fa5f946aa2f7f01772b60330b5a7cb42db6e7e0145c4a98450d0000b8a04b992e0ba6eb2c026930a582d107a910381a40000000bba538f5cb271648a85c8350e78c539a7caad7d8b613539691d2de369ec529a349dfd86838c7bde709ae818e3dc915cf194f890bdfe586e4471475f4e79f8b49 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\0bcad\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b0400000002000000000010660000000100002000000087e61428524689253634c7baccd982eb52ab138ce79678ee3e3f7dd883041f0a000000000e800000000200002000000090ae0c0d415b0ccc403df3c1019c162cf38ab1ec343858fd0ec977737ba3f69a50010000edea794395be4ed44967eb931e78ef39ec4f45f2f4001d06944cf200e35ea07f62eae8e868300b1177a2b3d1796384f10cd36456953ea1374fe1390f31bd0f2da8c24cb7c1703638580e56ae9ee4f0b811a0e0619211a44c69967a687119b46a395a06aeb4c76c0c600e68488a525e12cc3d69bd1964a34be1e16cebe209f925e2becdedee96d085f6f69a2bcdae69b703048f72435a7bd6fd55416c6f4ac2451d3f4029ad9177df18fa3d662ecb1fbe99a02b6c6a529459a1e0ac49a503c61fe20c57f65745e6cd84d99ab4244a59bec74ac557a620815286b07312591672153b98efd72956dd70c85ab17ef193479dde4bc51807a2ba306452a081de193a45f1be00fd93b9074ab0705a8a113931bb14df6f47f75a4781d7defccc151703b64bdba4526dda963022af82efa3951dcb3b4c06cd6927c1e9072e715076905bbd5ab866b0ee4b0d7e15c304b5467117ba40000000bae4c7bba4decd8d70c9f796ffe368b0daf32c5c9c88aed7935aa6818bf442c03803da76a59c50721c1e73da4af2894337895d5ab5834d629c17e168cfe3b689 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\ = 480affff430affff3e0affff390affff340affff2f0affff2a0affff250affff200affff1b0affff160affff110affff0c0affff070affff020afffffd09fffff809fffff309ffffee09ffffe909ffffe409ffffdf09ffffda09ffffd509ffffd009ffffcb09ffffc609ffffc109ffffbc09ffffb709ffffb209ffffad09ffffa809ffffa309ffff9e09ffff9909ffff9409ffff8f09ffff8a09ffff 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09265\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000ade369687680f6a4bc49fd60360485fd297687c8426c3bd145de8ca6df689ac7000000000e80000000020000200000008ee3d21b097b237cec257743a7d8e3d5b003f699d8def32a2009428463476450f00000003a37910464b5fa325ddd058d43178d45414ff9f2f79748de365c86d32c39f3d73ccfcfdc38e2e0049fffebd0eb337a528658f8021c610cdd66a5d01a24d94c2b60d7f318761834677e69d056d80cdf7d64d20ed4b48eb785760922cf864395ba54e71947e635e661bb0149739bbe3793a6fe359eb6a89ff55fb119ee02a86dbbe0ac6a0dc0ad8552ae3d4fac8a85f6a706575506ae7c5d61e1a73bf3509e88b4ce7dc0badd539a1e1b3cd75201376b594c3f6acaa2b7ffb1e6b394dbe0f9a7e5432e085f4dc215af8e2d579d6e75dadc9f4d9f7e172112dc47cb8810e4fbbb93ccf182235434b30c25ddef928c6b65bb400000005585561f7cf005173e5afc94a28a7969b40ca8dc1c83476be7cab75016b0c2668bd1df01af3c410713ca2258eb1b256cfdb807532f15cfac0d393456e0a8f725 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\0bcad 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09263 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09279\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000005726322d02eb4bc7b49012027e8bfd43804a0990651e648346256c6daa16fda4000000000e800000000200002000000097cc66f0c1b9e1d2abe4f632e578e30a8204dad161149f35e13b2a3ea61a4feef0000000a77f4549fb5d49e275a216dcc340c76f921f455e82035301fe71f6d2ce4b647200825e114176e5ea6aca802fb2d28130f131d39010839b6bd0e93061615ba951cfd99948422d9018a04a892becab354aa8168aad177aed71bf77b40c566085b95ed80140ed3b6446bd70e985d882fb063efed80cbe853eb7d90e92059e3fa200394783f8954137146cd16d80dc5aedfed7240077b428e770137d13696c1d429042168be04eb09ea932059b21f948ed945b90da815067a45b21c5cb7d43b6450f51398197c66f23d9e28059e45948e711f00041e913f88a4cdac2cccbc11fd9fff35653a62805380251e8e91762824e46400000008973d341d443fc35bf24ed5e959d6a01bd9df656ab6c410f089431492b8f58dbf223f65432fa1422c361e7fba7124708bf644b3eeae82e3fbddb3837920f2b3c 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09277\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000d24822d2220698e3049fd0436267428fbc71c6e139e72147d20bdaf1a18bb0ef000000000e800000000200002000000015b0fd89a6656804a58f2d599fefc248f9431471d583ec5f60da9a857b4afb97f0000000471b7c70e7c01622af7f57fc372faaeb5ad5c57efd3dda8b21a5ebd1840468fe37227f8760b5c40b0708d0a7eb60e178c2c8947b3aa7a93211783cf7e58ea294551708deecca91dfb42e4500a9064df8419874bf4cc2df5e9c264b6d1f38160fc85d300bb9225073172efaab053ca230cd83557daca3b09822fdcfd9b8534d2971572e501741430a6e302fa7de6619388e423986f65b08ce9db2f4c082304dfc694a5557f7413b6084b43035183be657351c813ac92030df6cb7a05a26a3489c10a3e36fefa3348ffeb9fd99718ca1413cb864feda43e8f27a0a99bdb65d767bdec8d279e5f2350e2f135140d22d638640000000cb4d50eb1a426068d80a7fe47a4b49938a9d81f7de16d7e58d6d253450b7af4d40368336fb2cdf219d5f888a966c5d605254f5208cbbb9977cc03d479ec97b53 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09275 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09275\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000ac56f447f4dd301ad1f4145346b6c819f86365773a739007cecc09be38f4ce17000000000e80000000020000200000008a6b6947dd5ab5334a78ce48b99a74000bba34f1da3b37836236c2257e0753ccf00000000f18331e2e83d2b8e910cc8e2fc50fb96299fc1ee88e074121c5f65b990d521bb372b179d785677ec04edb72eba0e3efa56e7705ef8468e7af7e1013784f0a253480dba457309c7ea6bbbcc302058f61d51124a1145e9929444f8282a641ba15fca55a94ffa3c257f4d6328efa3a60203b1efef971e9688854bc210ac03d0b8c51a0efa07fd748f46da16a94d36e1a175503226fa6d8789c0ba25b431d4d7471c1d6414766c091159982c0920406ee1ed855e05095ecace23771f92ef8b95b7452adc0a6d990255789f6ebc84c3161f976604168606c4f7af2b670a6dbbfa56d6b85f799d6d34d23b554bf86709a886240000000dc5b2c20f18173439629a088058baeee419ec7814d9b4037978bdebe21200827e0593de249ff8f416275f1871189536b80163009672a9dac763bed8dc69f768f 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09264 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09265 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09276 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09277 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09280\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000006036c13fd084d6e3bb262c1ad5770ff13a715c66e1c52258bf97d24c3cb5731c000000000e8000000002000020000000f19f42b8cc767971243055073b6c9c1ad824ccf149ae141d9574f7bb5e8297c6f0000000e65c7b0f982728095f7f63f74ce2be3f2623ed106bc71188aea7fcf6bc32edcc07ec16193bb7dc83057de1904405540e0255e670e3ffa9a82652722e66d42713b085cea310a4968e4b752fa20d1f7675c6f21545a1c071d7ec9392ae744dea483e9e96d6727afce7f9d07d601e8e845fe4b88a92ab2f7f71b47a59bf68a0daf195490c037ca2c896873a73e335ed25182a1ab79430c234f1d9f82999a8e19df953bd0d29be33b4a0158b3e186bb26c339f4f1f07b7cac49bf2462fdb1d016b9879509d48fe96342956b3c3a876ba0e984c221e38ea2b392e3e1ecf1370c6a81c89406565821f480b79cfc753debb100d40000000d02ed83f53bf8a1d3cad948addd453c0fc91c4efe39d898061a26d1f8c97539d1bcb7aea75eaea98b0dc1e8e64b28e03171af5e3384cd2fcaacd706f68712803 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09260 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09299 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09299\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000bc240bcbd8231edd702ac7f8611d721f53c9becee457cf1ddf441959b2e69a1b000000000e8000000002000020000000e01d4bac9a79903b08511773c9d8cbf70d56dfe62b5f3f921fbe5cefde0bb5e0f000000011a98daff964b2862758b84928636df6df5a12331bf33cb152cccecc901999c956e704270bda8fe962cac24654544c49a918b4e320aa8abbf254bbf64d4054e8d0c9b82870a7b4754c3b094e527864e532583fa0eb308a8f18cb51c8f1ea996367697032606f748b7884b90b59b8b16ec8f7d397a3b14a40b56801bb8b53f49f770c15403b00252995f4db0163a507328245bcb3d43a642fee5ef8a98b106b98edc94c21977694b30e04708050db6381cf2b024a6a454388dee393fe62facd942cd08b9bfb824171fedad50075d48519ae0d94a3496f1e0bd8707c2f6fbdd35f7cf2888b852d9c03ce8671f8c3fef4cb400000006ae91b4a3552970bf399c769a0fb5025fec77c32e6f4624ad88644262054442b1d39bbc5b33b75d80ca01a3da33ec10be72ee6640a0b653500a2de5b2e8280bc 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09260\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000c44ed6e61df992c07d45cc4eeff92c7f2d609e4ef1132c7accfa24a7cdd982ac000000000e8000000002000020000000c017f157c33b3b1cecdbea3bfe88cae0d8ac125ca8d16688c8847e48f1502685f00000009d6ddb72281d3bbd8386bd50c2ff7ce7fc807f590b126779ea4d051f703b293c1ecf40b3e11ebba0e85d38e6a74c073a5d345ecf1c0a5998a6d969201d20ded8f6bc3d6babbec3f5375606f718d1e0d748faaf081103d76d3f1e751c3f8068eb6eccfe6951e83a493f7e21425289e22516c0a85007b9b275b13073ff35f87b30432d6a264be7d9a3a00aae1aeca39b33f0df0ea481138f7bcc6f6d3e22fe4c2ae048ffd044f0aa9b878004201fb92818ed17e9fdf4fe6bee4a99c3012c6246687776b49f4ebd9ee78103d67385af689a41f78301b5e571d1a29de34880e40eba7e1d308d19c1fd0dd88176e92c8f0ac640000000e2d2445d3de1bee7f9131676ec2a72bc2bb702d9ccf5ca1264a7f794ac43626d012815980d58bd9855bcf32d5cecfbe42b876ad49596ec768fee0e7ffcabe921 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09262\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000001638eadc61fca47df352d69ce0875899198affb1b720d13539ba48f67b3388e1000000000e800000000200002000000090413fcaff5efb1c482870d56e40a0023a54f158f52d58440e180afb50bb9172f000000042fed693c62189865614cbc3a5ad2e6fc225a8715e4683e4ceb9c305e463d3070004bbc0e7ca255f5ebf38773147463ac1e39135385e587c4a367a8ab39491b1f77e138578cbb0319198231ae607d62bfea735b6c9929f87703a5c4e6a99f33628a8bb42c38fca521ffb7f8dc12ccf88f396db28385a4ab1887647d66c466b60f4a7f8a2725f55feb88d273c91b2e5b211f120004736c6b155052ac51759092a19bd80cc0f5001c84545f77a097f4f06ef464e760720049998eedca87d0532d42028b89ca5921aff88e1a54ff7f544aed64515225bd8d6784b3ccef3f0627bcc96e73b2b384ca4bc9b47e7ac854a096e40000000358c3fce76e3745b2c704655572a7b7badd456a0e4b7d6e5eac5bf8782f1d2e4f5b705342282a90f60096b14961ffe50ef6ffe7d92cbd932aaff01571456ecb0 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09279 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09271 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09276\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000fea1e295c399cccdb846a2f0bc477deebf803cb99ffe527c0e879111c7d7fae1000000000e800000000200002000000028c714616d5b8bf64147f49438a5d4575c710ab20ff5eb292ac492efdc2ccd9df00000007c05dbbc110db02528a506cd258cfd0b6bdd3c9c5da9694f42b28b5db9afd8142fba1f664d99b7a599c071dcf09addd494c15b6e64889ff0f7334f2ba52f993af65f4d51faf038c29f14709c4ea49b0a41cec21f9f89d9b2b47431934d11de11596e29832306495243c803ca612456361a54a9bbe97422ea5e77e6abc9e82c327b566723cc606df2976564b385471e994285b99e0f06298fdea04b2b35be7cbc2e3553922ed350271ef6b44fbc6a60af19e44e814546c3d235ea8f7851e76b7218237bd532f516929ce3b0ccefb24167b04fbb8d6ac9b784f33faf6d3917951cf09198967f058c203b93b382ba4871b24000000077bb51f3a1c148fde53d18bb923f6243ab54576b10f4553e467cdbbce27897940654efa58e7f7baf30f49e45281c3f7e7f250d61f4f1be4469897d9b559bf45c 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09262 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ehRec.exeaspnet_state.exepid Process 832 ehRec.exe 2096 aspnet_state.exe 2096 aspnet_state.exe 2096 aspnet_state.exe 2096 aspnet_state.exe 2096 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exemscorsvw.exemscorsvw.exealg.exeaspnet_state.exeEhTray.exemsiexec.exeehRec.exevssvc.exewbengine.exewmpnetwk.exeSearchIndexer.exedescription pid Process Token: SeTakeOwnershipPrivilege 1728 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeDebugPrivilege 2348 alg.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeTakeOwnershipPrivilege 2096 aspnet_state.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: 33 1940 EhTray.exe Token: SeIncBasePriorityPrivilege 1940 EhTray.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeSecurityPrivilege 2972 msiexec.exe Token: SeDebugPrivilege 832 ehRec.exe Token: SeBackupPrivilege 2624 vssvc.exe Token: SeRestorePrivilege 2624 vssvc.exe Token: SeAuditPrivilege 2624 vssvc.exe Token: SeBackupPrivilege 2696 wbengine.exe Token: SeRestorePrivilege 2696 wbengine.exe Token: SeSecurityPrivilege 2696 wbengine.exe Token: 33 1940 EhTray.exe Token: SeIncBasePriorityPrivilege 1940 EhTray.exe Token: SeDebugPrivilege 2096 aspnet_state.exe Token: 33 2944 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2944 wmpnetwk.exe Token: SeManageVolumePrivilege 1760 SearchIndexer.exe Token: 33 1760 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1760 SearchIndexer.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2692 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EhTray.exepid Process 1940 EhTray.exe 1940 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
EhTray.exepid Process 1940 EhTray.exe 1940 EhTray.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
SearchProtocolHost.exepid Process 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe 936 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mscorsvw.exemscorsvw.exedescription pid Process procid_target PID 2692 wrote to memory of 3044 2692 mscorsvw.exe 38 PID 2692 wrote to memory of 3044 2692 mscorsvw.exe 38 PID 2692 wrote to memory of 3044 2692 mscorsvw.exe 38 PID 2692 wrote to memory of 2092 2692 mscorsvw.exe 39 PID 2692 wrote to memory of 2092 2692 mscorsvw.exe 39 PID 2692 wrote to memory of 2092 2692 mscorsvw.exe 39 PID 2688 wrote to memory of 2744 2688 mscorsvw.exe 40 PID 2688 wrote to memory of 2744 2688 mscorsvw.exe 40 PID 2688 wrote to memory of 2744 2688 mscorsvw.exe 40 PID 2688 wrote to memory of 2744 2688 mscorsvw.exe 40 PID 2688 wrote to memory of 2584 2688 mscorsvw.exe 41 PID 2688 wrote to memory of 2584 2688 mscorsvw.exe 41 PID 2688 wrote to memory of 2584 2688 mscorsvw.exe 41 PID 2688 wrote to memory of 2584 2688 mscorsvw.exe 41 PID 2688 wrote to memory of 1868 2688 mscorsvw.exe 42 PID 2688 wrote to memory of 1868 2688 mscorsvw.exe 42 PID 2688 wrote to memory of 1868 2688 mscorsvw.exe 42 PID 2688 wrote to memory of 1868 2688 mscorsvw.exe 42 PID 2688 wrote to memory of 1276 2688 mscorsvw.exe 43 PID 2688 wrote to memory of 1276 2688 mscorsvw.exe 43 PID 2688 wrote to memory of 1276 2688 mscorsvw.exe 43 PID 2688 wrote to memory of 1276 2688 mscorsvw.exe 43 PID 2688 wrote to memory of 2084 2688 mscorsvw.exe 44 PID 2688 wrote to memory of 2084 2688 mscorsvw.exe 44 PID 2688 wrote to memory of 2084 2688 mscorsvw.exe 44 PID 2688 wrote to memory of 2084 2688 mscorsvw.exe 44 PID 2688 wrote to memory of 1284 2688 mscorsvw.exe 45 PID 2688 wrote to memory of 1284 2688 mscorsvw.exe 45 PID 2688 wrote to memory of 1284 2688 mscorsvw.exe 45 PID 2688 wrote to memory of 1284 2688 mscorsvw.exe 45 PID 2688 wrote to memory of 1864 2688 mscorsvw.exe 46 PID 2688 wrote to memory of 1864 2688 mscorsvw.exe 46 PID 2688 wrote to memory of 1864 2688 mscorsvw.exe 46 PID 2688 wrote to memory of 1864 2688 mscorsvw.exe 46 PID 2688 wrote to memory of 880 2688 mscorsvw.exe 47 PID 2688 wrote to memory of 880 2688 mscorsvw.exe 47 PID 2688 wrote to memory of 880 2688 mscorsvw.exe 47 PID 2688 wrote to memory of 880 2688 mscorsvw.exe 47 PID 2688 wrote to memory of 2960 2688 mscorsvw.exe 48 PID 2688 wrote to memory of 2960 2688 mscorsvw.exe 48 PID 2688 wrote to memory of 2960 2688 mscorsvw.exe 48 PID 2688 wrote to memory of 2960 2688 mscorsvw.exe 48 PID 2688 wrote to memory of 1304 2688 mscorsvw.exe 49 PID 2688 wrote to memory of 1304 2688 mscorsvw.exe 49 PID 2688 wrote to memory of 1304 2688 mscorsvw.exe 49 PID 2688 wrote to memory of 1304 2688 mscorsvw.exe 49 PID 2688 wrote to memory of 1816 2688 mscorsvw.exe 50 PID 2688 wrote to memory of 1816 2688 mscorsvw.exe 50 PID 2688 wrote to memory of 1816 2688 mscorsvw.exe 50 PID 2688 wrote to memory of 1816 2688 mscorsvw.exe 50 PID 2688 wrote to memory of 2288 2688 mscorsvw.exe 51 PID 2688 wrote to memory of 2288 2688 mscorsvw.exe 51 PID 2688 wrote to memory of 2288 2688 mscorsvw.exe 51 PID 2688 wrote to memory of 2288 2688 mscorsvw.exe 51 PID 2688 wrote to memory of 2260 2688 mscorsvw.exe 52 PID 2688 wrote to memory of 2260 2688 mscorsvw.exe 52 PID 2688 wrote to memory of 2260 2688 mscorsvw.exe 52 PID 2688 wrote to memory of 2260 2688 mscorsvw.exe 52 PID 2688 wrote to memory of 2876 2688 mscorsvw.exe 53 PID 2688 wrote to memory of 2876 2688 mscorsvw.exe 53 PID 2688 wrote to memory of 2876 2688 mscorsvw.exe 53 PID 2688 wrote to memory of 2876 2688 mscorsvw.exe 53 PID 2688 wrote to memory of 3052 2688 mscorsvw.exe 54 PID 2688 wrote to memory of 3052 2688 mscorsvw.exe 54 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2584
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 1ec -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1868
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 24c -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1276
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 23c -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2084
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 25c -NGENProcess 248 -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 250 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 1dc -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 248 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2960
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 23c -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1e4 -NGENProcess 24c -Pipe 1dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 24c -NGENProcess 268 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2288
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 260 -NGENProcess 278 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2260
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 260 -NGENProcess 24c -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 248 -NGENProcess 278 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 28c -NGENProcess 1e4 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2272
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 23c -NGENProcess 268 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1260
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 294 -NGENProcess 26c -Pipe 290 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1992
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 284 -NGENProcess 278 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2620
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 23c -NGENProcess 29c -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2124
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 280 -NGENProcess 278 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1472
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 280 -NGENProcess 23c -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:992
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 268 -NGENProcess 278 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2092
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 208 -NGENProcess 1e0 -Pipe 1ac -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2260
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 250 -NGENProcess 238 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 224 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2136
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 208 -Pipe 1b8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2960
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1c0 -NGENProcess 224 -Pipe 20c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:868
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 208 -NGENProcess 224 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2416
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 268 -NGENProcess 260 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 25c -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2596
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 270 -NGENProcess 208 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3060
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 224 -NGENProcess 278 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 278 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1312
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 208 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2580
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 208 -NGENProcess 224 -Pipe 280 -Comment "NGen Worker Process"2⤵PID:780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 28c -NGENProcess 274 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2572
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"2⤵PID:2204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 224 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2548
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 224 -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"2⤵PID:3036
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 29c -NGENProcess 284 -Pipe 208 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"2⤵PID:3008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:2368
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 224 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1276
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 28c -Comment "NGen Worker Process"2⤵PID:2192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 250 -NGENProcess 294 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 294 -NGENProcess 2b0 -Pipe 2ac -Comment "NGen Worker Process"2⤵PID:1952
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2bc -NGENProcess 2b4 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2b4 -NGENProcess 250 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:2260
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2c4 -NGENProcess 2b0 -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2b0 -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:2776
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2cc -NGENProcess 250 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1680
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:2216
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2a8 -NGENProcess 250 -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 250 -NGENProcess 2d0 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:1384
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 2dc -NGENProcess 2d4 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1964
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2d4 -NGENProcess 2a8 -Pipe 2d8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e4 -NGENProcess 2d0 -Pipe 2c4 -Comment "NGen Worker Process"2⤵PID:3008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 2e0 -Pipe 29c -Comment "NGen Worker Process"2⤵PID:1680
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2a8 -Pipe 250 -Comment "NGen Worker Process"2⤵PID:2504
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2d0 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:2340
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2e0 -Pipe 2dc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2292
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2e0 -NGENProcess 2ec -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2776
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1688
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 300 -NGENProcess 2f8 -Pipe 2e8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:680
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 308 -NGENProcess 2d4 -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:2492
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 304 -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:960
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2e0 -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:2716
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2d4 -Pipe 2f0 -Comment "NGen Worker Process"2⤵PID:2192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 304 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:1744
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2e0 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:1636
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2d4 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 304 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:1136
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2e0 -Pipe 310 -Comment "NGen Worker Process"2⤵PID:888
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2d4 -Pipe 314 -Comment "NGen Worker Process"2⤵PID:1100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 304 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:2616
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2e0 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:2960
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2d4 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:2612
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 304 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:1136
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2e0 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:564
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2d4 -Pipe 32c -Comment "NGen Worker Process"2⤵PID:1104
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 304 -Pipe 330 -Comment "NGen Worker Process"2⤵PID:2500
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2e0 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:2960
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2d4 -Pipe 338 -Comment "NGen Worker Process"2⤵PID:956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 304 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:2964
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2e0 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:2368
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2d4 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:1104
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 304 -Pipe 348 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2440
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 304 -NGENProcess 358 -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:1548
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 368 -NGENProcess 2d4 -Pipe 350 -Comment "NGen Worker Process"2⤵PID:1744
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:1628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"2⤵PID:2788
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 2d4 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:916
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 364 -Pipe 360 -Comment "NGen Worker Process"2⤵PID:1388
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 358 -Pipe 304 -Comment "NGen Worker Process"2⤵PID:1284
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 2d4 -Pipe 368 -Comment "NGen Worker Process"2⤵PID:564
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 364 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:2640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 358 -Pipe 370 -Comment "NGen Worker Process"2⤵PID:1292
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 2d4 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:2292
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 364 -Pipe 378 -Comment "NGen Worker Process"2⤵PID:2204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 358 -Pipe 37c -Comment "NGen Worker Process"2⤵PID:2992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 2d4 -Pipe 380 -Comment "NGen Worker Process"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 364 -Pipe 384 -Comment "NGen Worker Process"2⤵PID:448
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 358 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:1972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 2d4 -Pipe 38c -Comment "NGen Worker Process"2⤵PID:2220
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 364 -Pipe 390 -Comment "NGen Worker Process"2⤵PID:3016
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 358 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:2492
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 2d4 -Pipe 398 -Comment "NGen Worker Process"2⤵PID:3000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 364 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:2236
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 358 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:2716
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 2d4 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 364 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:564
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 358 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:592
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 2d4 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:2760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 364 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:2756
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 358 -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:1744
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 2d4 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:268
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 364 -Pipe 3c0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 358 -Pipe 3c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3c8 -Pipe 108 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1624
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d0 -NGENProcess 3e0 -Pipe 364 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2640
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2836
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2888
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1980
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1272
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2040
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2664
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3004
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
PID:2560
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
PID:2452
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:780
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1940
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:2620
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2124
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:316
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2360
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1508
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2268
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1524
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:936
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵
- Modifies data under HKEY_USERS
PID:1152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD5ffa624318f9c1b025564cb5791eb2fee
SHA114a57a68ca7dbef8d1d8c3f4f2995289231f129b
SHA256850a0578d2a05f7b488377bbbcbdc76313a592160f47a6f385dc75df4bd51b94
SHA512556bcd891f00f6b6a7a6f0c47cb68783ff8e8e6f36e8e4cf3d36bba4f8a3de7e3d8d335794f8d28ae71cc4658beb5c19a909ee0b1318433eb8fc46c548d2784f
-
Filesize
30.1MB
MD5e9de325dc06b646689751fd62242aa9a
SHA19cc36b9974536fd2e80da0d621dcfe0dacafefaf
SHA256e5e6f77dc554b4370f33fc3f949d670f4fb56e17e4d2db3c3b6b1eb10938516c
SHA512435e06600af00c121fb5d21d512659663c6a49a4f34ee5bc9d7505d09c7ee212d0c2d2f138e6357623f425db5bc0656b4510592377cac8c715d74817467859d6
-
Filesize
781KB
MD5ef501ce8133cebbe220e615a48b801ca
SHA10e188c45b52bb5cc2e42efc3d17aa2e21595ab6c
SHA2564fb5e8aa8f986efd8ba5ecd5b11db20d6da8312882f747ef530b0a4b13fb86ae
SHA5125872ac8393150eca46efcbaa7b463dc1ca73d1643a2a595e04d7f9f6185705d5c15d72d827f20c5d39f9460ce4984c32afb29d66516793bdad7d99a3dbed0c2f
-
Filesize
5.2MB
MD565d2e2d0b6297019f77ee359a134e005
SHA1f6671d733502fd676ae5be8225e930e5fba72d1a
SHA256b938fc8a8ac39167dd1919372b46b1dd8e479bc144011e035b67654087cfe739
SHA5129e7f308a3a426653385565e4e376b9aef433d07a1213af602f00f80ec950d0e4b8ca9243840a747b717f8aa66399cca7aab2cbc5caa821c930bfe70bc684e1f3
-
Filesize
2.1MB
MD5b1473e88208431e5443568627f901148
SHA1771f1b462a4a457814fe34f2d0a562177bde2e05
SHA256b6ce78d97ff437a5490311b2d304c2131c467fbcd3176ac0c373f1c45da585c0
SHA512190d4dc1a7da104a73793f9a06b7dc2a3f6901f11ad342ef2415cf54c541d230261bf6be663b2b6ed25ac196245e0d91b7f8a11bf59577d6c5df019277449f05
-
Filesize
1024KB
MD5f5b10799a616dd521a007cffeb92b9ef
SHA1c6eae24297ddb12673ed3617536b0b79e082ae85
SHA256293347c594baa34bc956d54f5ee37b4b8f8e930c2e538793682883dd588d3eeb
SHA512913b1e139fa7f62acf36c833f1fe8b61aba9f1604eec93a6208e67f5f7f2a6fc7d1aceb287904505e412266a0fd86746839e314405683b047e3ed0cf7ea6f3ef
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
648KB
MD58dc4ecb9ecfbacd95c53b96870d91aed
SHA1341b59d7fbedb4067148a13d4909b43bb7c13e0e
SHA25645d5cdabbde8403a74f0f29cf36658ad914424971cec3ad504f3695cb2125b92
SHA5122fec2d9cf97bd7df8b79d6e16a8b91fb96d35c53c07043da39d7235911c6bf17e84c4d08c13f33139149572f9d58d502811388bd0ee38d9382336e45af303ecc
-
Filesize
872KB
MD53a6abfef6a2f5e63bee4cb416d002749
SHA18a8dff4ad4ad08d86db6693518f3a9ab92a3c2cb
SHA256577013476ddb010f2556740bd875f7cd290891ed496a96bb8e7a1d8857abc812
SHA512fbd27a1f8ede38cd04035efe6659a444c431ea01078dc2944c5f303f6cb861e8fcf60d1edb27993a0b3f7f7f092a3eb0c3ee91c8fd726d487f0eb227b18509bd
-
Filesize
603KB
MD56cf5d2934b3721708ec572de713afaea
SHA1b013d85da89b5f9d57654e3d94828391de2e330d
SHA256d4558e897794594920e132a473c73310e54e2bcdec726bd3298c2e9eeddc6c69
SHA512874c036453e0ca741deb9288c54d8d8aaed46c6682e5900f934186f4283ec132239c786adc2481a9797eb9b0a0f5c0a0eee5834c6569fb64ab703bbcd75a0cef
-
Filesize
678KB
MD5b339b556f8ff257f3f4f30ec10153067
SHA1df87b5a95d2ad422716da8d21b9be02d9fd6d074
SHA256ed879603c5ea2118c832dd65f5a20eff868fb84432a818eacaae30ef567b623a
SHA5121a3e828c2e487f41167097a13e29091af49ef61796c9898612141e1ccd8d048710b535f4d29cb21d987f73c0907c483718a7b0661134d8f9ae61f8a6cbef5818
-
Filesize
8KB
MD5b9fa67b129d8a3fd4d5207afb4751e27
SHA1bcfd22ad2c98b0247426d2df374fc68b62407ed1
SHA2567240a877ddf4c03158e557f67269a7c36b321addee0460fcc5878ab8ddf331bc
SHA51234489529de30c5f89b28e1eb51af66f65b25e76449488f0d03e19c8263e4c23d38df14f35a7eefcfb95f08467bb10c2b41f7364559721e4097632f04ee8fa722
-
Filesize
625KB
MD5b333863d830e1b534891e54b779d44e1
SHA12065a35cc86b0ecb4978bb1a7bcdc4c7cfeb8f37
SHA256cc705393aece4e1c27c6f08b2365c59830107855f4baf249d9b3f75e96a05c29
SHA51251f2042d5e4bb46a39f9effca12103c677e50a16bf0e2554b91f4d998f339b0a217cce01d684dac7c423e4e31a580532b27118c92c4049d6796c1cc36e606278
-
Filesize
1003KB
MD54ccdd43d0d1d12f21bdc027c45c50a83
SHA1767d969024d2884b494ca7bc1dfd60bc21d967a8
SHA25666c71cc185551c95522adeb0d186bccb522dda795e134d188e547be48ccb202e
SHA512aac9d5d89094a784612d1de096da975fe251c0506ca748adb7b62d736f1025064f91f205403217e9ce598f70cc2c4bf9e12204891904f1be70f6fa4b0bab954e
-
Filesize
656KB
MD57146952559a2dd4c6193ff3c5cb7fc80
SHA194404214ec499f37ba94248a3dab80bb2ff82109
SHA2565e5dd8db1c192cfb65a4cd317d15578187c84158577930864efc5aff8ab51c32
SHA5122a099c0260326ea42dea229f5f2cc645513ba66e7978a8381e496649ad1e348337c0bc83a4756c7d3511a2c936f7b72b7cf8ceb50a8a9587cea0daa00af26003
-
Filesize
587KB
MD575c0b938b70f497d3ed281bc3442cfa3
SHA18cdb440dd608389ff1ade302b256b9fa4ba1d2e5
SHA256eceeaed2043ff6c12935562e09a0e8a60cbca9b5118249dac0245ffa4fa3b13c
SHA512d615dad8744c25f0902c88e157b1acba6934d13bc8acaf4ada203f1938d0da6b3baceef402338b4e9663db74c80853b17bd057c400517cd692b05c23c5c4ecfc
-
Filesize
577KB
MD5b941b4e92ae4aa9077ddfb7c1d49831d
SHA166ce017e9cb9dc200e1f6ecc4352bebf9dad2715
SHA256843732acfa0c558b3581bf4aa7e09d34cafe135c7248522e00e4d5f5d75e8c9f
SHA512479d3cd9d887e4e68b4411822fa3d04c25e8e36be3d554a65ee29b9cd6ea4666b29cb527fd5802f354880ef18c4bd8e3fd087b3bf51a5baa33735937ffc37666
-
Filesize
674KB
MD5a82c2e20c878ecf60d64540af8ca6c26
SHA17bdde53c13ab43274d0f4748232c157897860aef
SHA256e7d66b087a3a0c03c275d35da0e5e0ad2dfcb391168244ec1ce536393c6957a3
SHA512ad61140d99c24df8379d6462f84e46b4a9b8f9574c8b6fdece203c6cd848b835bf0b1681651b74fca6c327b647a3b157ff59a90ba77eff5adf763e37782812a4
-
Filesize
581KB
MD56d0df463dfc32d62562ee3369e288f36
SHA10260dcadf6fc7a84fc98c794f19aa4e4e62fb03b
SHA2568a11fa896fb1531344ec52370a56b96da5a570f7a6fdada923c430eabb0f0e26
SHA512368031411c4c3dcf4f3935ba29457b81f3fd07a43ff7d491e3a6d058d5f7656488e04257705c1e04abea6708a98663bb3ebfd155266a28d459b4891e6b45effb
-
Filesize
1.1MB
MD5a19392f5e76c3587231cd4bfe9b1d56d
SHA112621d8ffc42e12c81ab9628850ec3bfd28ccdc9
SHA2565022162c308ca459d7fc4494c0913dff5ca7288b8410aa7a2d0c46296093328d
SHA512ff3ef31c5abd704fdf2453117be76fd7ef493eff053b22f52e5860bd8e796d081e09510339e763c8b8ddbfc70bfb27c68f2ea51088b8e9dd8256e0d341a05699
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
Filesize105KB
MD5d9c0055c0c93a681947027f5282d5dcd
SHA19bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA5125404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
Filesize248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize1.0MB
MD5598a06ea8f1611a24f86bc0bef0f547e
SHA15a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\7617cb5cf0b5c2e9ffe4c34fd5a560f8\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize221KB
MD5458f724ed911827c02c55a1482387080
SHA1d3714329ba042704ae13bed5c4e3aa3892d0eeda
SHA256d11dd07bcac23dd68a6c707604329cdb07beddd1fec6a3871b556a2d52c60ca4
SHA512b4ec62e8b3484947e5df0b5467c81c12daa795281cf0d1c8e8861d01416ac3474bd329f40bd1f57a8b24539591c420634f7ef17128acc207b8df68a7efc364a5
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9d6012f07b15d13bce0269b033935cbd\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize271KB
MD5edb0fd1575cb46d0c367cbd40cf60292
SHA145b6e18c4636524edd53edbc3747faf5547c278d
SHA2565833b490826eec6ec0132a50fc0004663cb2adc1a8f3e55b11048fc2a37bf761
SHA512f550f71c7612d7219fe43a431b4b2e7c1bb9409e0eba7d1ffcc1e36ccfd8cef84edcdb23aeb59f927c961af701b2ab3ac3e30a359e93d611ce92a7549eaae23d
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d930e1d9d837e34a28ecac066efa7d5e\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize305KB
MD59adaae07a0024105f78bec9de948183a
SHA1e21bf8df1af426160f5a919081265565edb4bcca
SHA256121d510dbc4562a51f9018839c3d70f791f70f9a97e873a36b19c238ff7f258d
SHA512a07ec5d250fd7febb2a1da66b407560ecb755284d7cbe6016982cd19b4e3046fda69b5a692c72ecd355d9a117501efab37fd0f3ffdd675344bfa71bac0b79a85
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\edb26cfd1ae973cd1ba350e4cb62f2d2\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize122KB
MD57e1f15da6cd79b15b351f68fd40244e7
SHA12d107e27b1d35a3857ad38a788e96ed13991e80d
SHA256699a913e9444d84fcba164cc8e3cdde19e95785f5aeb7998f8e73a526648cfd5
SHA5122d3f56949d04b60694b7f9c433cfba8a5b990eee7d9455c2705c00476e4d8083bdd558439da20d7e7add0dd441574ff3535cfa8fa0c4af422fd911d3212b6c94
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
Filesize124KB
MD5929653b5b019b4555b25d55e6bf9987b
SHA1993844805819ee445ff8136ee38c1aee70de3180
SHA2562766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
Filesize2.1MB
MD510b5a285eafccdd35390bb49861657e7
SHA162c05a4380e68418463529298058f3d2de19660d
SHA2565f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA51219ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
Filesize88KB
MD51f394b5ca6924de6d9dbfb0e90ea50ef
SHA14e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA2569db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
-
Filesize
644KB
MD5695813fe02086145f5a008b42f1e8502
SHA16c76d791c9c1ae8dad924dbefef9925625cbc5c0
SHA25622e667b9179fa62bdcddfc5081fc6fb592b4dd4c00896676d510dd9677d56c79
SHA512c1225d56e8a561e6a740c84a52525f0b442426df5e277cdddcf39095134765fee7de743817d246af5ef8a138ac11f364d443f80ec0fb0757a4e537ef869c1afe
-
Filesize
577KB
MD54f3ab9698dca88ba959f9356bfffac2c
SHA1aa9ce9e0eecb9eab8283635919c1f7f84783d8a4
SHA25631c4e57a4dfe053f9fae49cc4be91518ba1287f42475b7825ca9e7b0eceff9db
SHA512266172c3e123ef8a71abaf89490e0c03783560b0eb88ab84eb3b3d70d1ba87d5cd9ca400b35968ddb5fb77d0d22ee45e9379169f4fa61b90ac0c3842a5ab47d1
-
Filesize
705KB
MD5c3dfe760f27c3fd221d867012ca0d036
SHA1e271bf9ae209c5f1e485e87609eb7db5c4cfba12
SHA2565467a34b1ccac602d472740c94161e461113e0abe86266bfb23c5ba2458506bf
SHA512a7f866ca3c725f2b1806d6dca4194c211503f1155383a6e8c470cbef8ae95752352dcebf64d43ed27a016f779d51bad3bff668ccc6cbb186086c249a8d10a35c
-
Filesize
691KB
MD57937fb933771a99d4e55d2c5fc38f8a8
SHA1d8712623733e82724d20daf7896d323d59ee732f
SHA2560f7ab6edc034c7005c585daebef473035457abb115f101bd3f4251253d7cce50
SHA51229e1501e978c9526866a827266095cc117e9e9a2dac91f93ba2290b646ae46c61f1c5e15f2ba16426dd60a74161f89ce42b7afa456a942162cb0b6d689556902
-
Filesize
1.2MB
MD535ebc628901d4a25a44a888ffc92e7ae
SHA1866040b2422179696496558c386d09a9d45f9638
SHA256dcd2123d70f2dda7e76fb73ef4eb37b295cdaa9d2f38bba227350ae5b628c1c6
SHA512f4e94b8cf2d6cbe9887bf96e5142f30fcf33a3e1e4d96df6f9271a8d42b0dc4b10abd2858ce8d37660f8e576ca3f7f5a44c17e9c54ed641115ac50692fa0d4e1
-
Filesize
691KB
MD5d602e9493fa6f8cf78aa387992bdfdee
SHA123606d9d59d0bf0dfb2713aed06fbfb731f0ac47
SHA256396ea663cb97505ac216ba6f4429a7c027a64ed6c615cd1fe56673631de81a96
SHA512d5ef367ccbd043653e1efc2dc5db7e8af306d885db66cdc0925cd60d58de4150483d533b813162106c18adf4031436da6ffa7f20b5368e75bb0609b5bf5f28eb