ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
Size

1.8MB
MD5

9c6825ea57e1367501078ffc44524ca6
SHA1

c7a534b2c9890a2326bfb49525c05cf82d1dc2e8
SHA256

ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94
SHA512

2b75fcf16eec0cef29e31c43cc445a097bdba5c3c2e9cb2343640164185824abb684c216fcfe6009b2e2793b4afca6e7eab0575b04d8852529781157eb653d66
SSDEEP

24576:OsIV0SK7E5Yy4rxUMhWpOlZAb6utlJVdeeWIguOL+4nDS2bJ7FQvx7p6PGRihyU/:mRxV49USWz6ZfjL+4lV7A6IqJao

Score

8^/10

credential_access discovery evasion stealer trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 64 IoCs

pid	Process
2244	mscorsvw.exe
472	Process not Found
108	mscorsvw.exe
1484	mscorsvw.exe
2320	mscorsvw.exe
2340	elevation_service.exe
2072	IEEtwCollector.exe
2468	mscorsvw.exe
3000	mscorsvw.exe
2864	mscorsvw.exe
2164	mscorsvw.exe
2848	mscorsvw.exe
3036	mscorsvw.exe
1352	mscorsvw.exe
2508	mscorsvw.exe
1736	mscorsvw.exe
2808	mscorsvw.exe
2400	mscorsvw.exe
316	mscorsvw.exe
1916	mscorsvw.exe
2112	mscorsvw.exe
1440	mscorsvw.exe
2032	mscorsvw.exe
2824	mscorsvw.exe
2716	mscorsvw.exe
1016	mscorsvw.exe
1132	mscorsvw.exe
1988	mscorsvw.exe
1996	mscorsvw.exe
2168	mscorsvw.exe
2172	mscorsvw.exe
2220	mscorsvw.exe
3012	mscorsvw.exe
2104	mscorsvw.exe
1680	mscorsvw.exe
2480	mscorsvw.exe
2504	mscorsvw.exe
2468	mscorsvw.exe
2900	mscorsvw.exe
3044	mscorsvw.exe
932	mscorsvw.exe
2840	mscorsvw.exe
1656	mscorsvw.exe
1676	mscorsvw.exe
2204	mscorsvw.exe
1956	mscorsvw.exe
1056	mscorsvw.exe
3064	mscorsvw.exe
804	mscorsvw.exe
1944	mscorsvw.exe
912	mscorsvw.exe
2500	mscorsvw.exe
1012	mscorsvw.exe
2508	mscorsvw.exe
1492	mscorsvw.exe
2780	mscorsvw.exe
2764	mscorsvw.exe
2748	mscorsvw.exe
2888	mscorsvw.exe
1916	mscorsvw.exe
2576	mscorsvw.exe
2036	mscorsvw.exe
1568	mscorsvw.exe
2552	mscorsvw.exe

Loads dropped DLL 64 IoCs

pid	Process
472	Process not Found
472	Process not Found
472	Process not Found
472	Process not Found
1352	mscorsvw.exe
1352	mscorsvw.exe
1736	mscorsvw.exe
1736	mscorsvw.exe
2400	mscorsvw.exe
2400	mscorsvw.exe
1440	mscorsvw.exe
1440	mscorsvw.exe
2824	mscorsvw.exe
2824	mscorsvw.exe
1016	mscorsvw.exe
1016	mscorsvw.exe
1988	mscorsvw.exe
1988	mscorsvw.exe
2168	mscorsvw.exe
2168	mscorsvw.exe
2220	mscorsvw.exe
2220	mscorsvw.exe
2104	mscorsvw.exe
2104	mscorsvw.exe
2480	mscorsvw.exe
2480	mscorsvw.exe
2468	mscorsvw.exe
2468	mscorsvw.exe
3044	mscorsvw.exe
3044	mscorsvw.exe
2840	mscorsvw.exe
2840	mscorsvw.exe
1676	mscorsvw.exe
1676	mscorsvw.exe
1944	mscorsvw.exe
1944	mscorsvw.exe
912	mscorsvw.exe
912	mscorsvw.exe
1012	mscorsvw.exe
1012	mscorsvw.exe
2336	mscorsvw.exe
2336	mscorsvw.exe
2536	mscorsvw.exe
2536	mscorsvw.exe
2024	mscorsvw.exe
2024	mscorsvw.exe
2308	mscorsvw.exe
2308	mscorsvw.exe
2744	mscorsvw.exe
2744	mscorsvw.exe
2440	mscorsvw.exe
2440	mscorsvw.exe
2296	mscorsvw.exe
2296	mscorsvw.exe
1484	mscorsvw.exe
1484	mscorsvw.exe
2888	mscorsvw.exe
2888	mscorsvw.exe
2328	mscorsvw.exe
2328	mscorsvw.exe
1652	mscorsvw.exe
1652	mscorsvw.exe
1908	mscorsvw.exe
1908	mscorsvw.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1506706701-1246725540-2219210854-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1506706701-1246725540-2219210854-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\G:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\K:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\W:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\V:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\M:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\N:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\P:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\T:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\X:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\Y:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\H:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\I:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\L:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\O:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\Q:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\U:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\R:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\Z:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\E:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\J:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened (read-only)	\??\S:	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\lsass.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\admaacan.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File created	\??\c:\windows\system32\kkhfokph.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\locator.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\wbem\befkhoed.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File created	\??\c:\windows\system32\djihmlfh.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File created	\??\c:\windows\system32\adqagfii.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\alg.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\lqjbdkbi.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\nopobkmj.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\bhdmlnim.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File created	\??\c:\windows\system32\ibpikhio.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\goppehfd.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\nofjfqne.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\windows\system32\jkeecajp.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\vds.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	mscorsvw.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\aegoqheg.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\program files\windows media player\efcfehje.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\edepocnd.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ohhmebdc.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	C:\Program Files\Internet Explorer\ijbfjhdc.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	\??\c:\program files (x86)\microsoft office\office14\mblimppf.tmp	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15c.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP65C5.tmp\Microsoft.Office.Tools.Outlook.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15c.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15d.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8DAF.tmp\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP3A62.tmp\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP900F.tmp\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP638.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index160.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15e.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPEDA9.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPFE5C.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPDF5.tmp\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP85A.tmp\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
Token: SeTakeOwnershipPrivilege	3052	ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
Token: SeShutdownPrivilege	1484	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	1484	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	1484	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	1484	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe
Token: SeShutdownPrivilege	2320	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2468	2320	mscorsvw.exe	38
PID 2320 wrote to memory of 2468	2320	mscorsvw.exe	38
PID 2320 wrote to memory of 2468	2320	mscorsvw.exe	38
PID 2320 wrote to memory of 3000	2320	mscorsvw.exe	39
PID 2320 wrote to memory of 3000	2320	mscorsvw.exe	39
PID 2320 wrote to memory of 3000	2320	mscorsvw.exe	39
PID 2320 wrote to memory of 2864	2320	mscorsvw.exe	40
PID 2320 wrote to memory of 2864	2320	mscorsvw.exe	40
PID 2320 wrote to memory of 2864	2320	mscorsvw.exe	40
PID 2320 wrote to memory of 2164	2320	mscorsvw.exe	41
PID 2320 wrote to memory of 2164	2320	mscorsvw.exe	41
PID 2320 wrote to memory of 2164	2320	mscorsvw.exe	41
PID 2320 wrote to memory of 2848	2320	mscorsvw.exe	42
PID 2320 wrote to memory of 2848	2320	mscorsvw.exe	42
PID 2320 wrote to memory of 2848	2320	mscorsvw.exe	42
PID 2320 wrote to memory of 3036	2320	mscorsvw.exe	43
PID 2320 wrote to memory of 3036	2320	mscorsvw.exe	43
PID 2320 wrote to memory of 3036	2320	mscorsvw.exe	43
PID 2320 wrote to memory of 1352	2320	mscorsvw.exe	44
PID 2320 wrote to memory of 1352	2320	mscorsvw.exe	44
PID 2320 wrote to memory of 1352	2320	mscorsvw.exe	44
PID 2320 wrote to memory of 2508	2320	mscorsvw.exe	45
PID 2320 wrote to memory of 2508	2320	mscorsvw.exe	45
PID 2320 wrote to memory of 2508	2320	mscorsvw.exe	45
PID 2320 wrote to memory of 1736	2320	mscorsvw.exe	46
PID 2320 wrote to memory of 1736	2320	mscorsvw.exe	46
PID 2320 wrote to memory of 1736	2320	mscorsvw.exe	46
PID 2320 wrote to memory of 2808	2320	mscorsvw.exe	47
PID 2320 wrote to memory of 2808	2320	mscorsvw.exe	47
PID 2320 wrote to memory of 2808	2320	mscorsvw.exe	47
PID 2320 wrote to memory of 2400	2320	mscorsvw.exe	48
PID 2320 wrote to memory of 2400	2320	mscorsvw.exe	48
PID 2320 wrote to memory of 2400	2320	mscorsvw.exe	48
PID 2320 wrote to memory of 316	2320	mscorsvw.exe	49
PID 2320 wrote to memory of 316	2320	mscorsvw.exe	49
PID 2320 wrote to memory of 316	2320	mscorsvw.exe	49
PID 2320 wrote to memory of 1916	2320	mscorsvw.exe	50
PID 2320 wrote to memory of 1916	2320	mscorsvw.exe	50
PID 2320 wrote to memory of 1916	2320	mscorsvw.exe	50
PID 2320 wrote to memory of 2112	2320	mscorsvw.exe	51
PID 2320 wrote to memory of 2112	2320	mscorsvw.exe	51
PID 2320 wrote to memory of 2112	2320	mscorsvw.exe	51
PID 2320 wrote to memory of 1440	2320	mscorsvw.exe	52
PID 2320 wrote to memory of 1440	2320	mscorsvw.exe	52
PID 2320 wrote to memory of 1440	2320	mscorsvw.exe	52
PID 2320 wrote to memory of 2032	2320	mscorsvw.exe	53
PID 2320 wrote to memory of 2032	2320	mscorsvw.exe	53
PID 2320 wrote to memory of 2032	2320	mscorsvw.exe	53
PID 2320 wrote to memory of 2824	2320	mscorsvw.exe	54
PID 2320 wrote to memory of 2824	2320	mscorsvw.exe	54
PID 2320 wrote to memory of 2824	2320	mscorsvw.exe	54
PID 2320 wrote to memory of 2716	2320	mscorsvw.exe	55
PID 2320 wrote to memory of 2716	2320	mscorsvw.exe	55
PID 2320 wrote to memory of 2716	2320	mscorsvw.exe	55
PID 2320 wrote to memory of 1016	2320	mscorsvw.exe	56
PID 2320 wrote to memory of 1016	2320	mscorsvw.exe	56
PID 2320 wrote to memory of 1016	2320	mscorsvw.exe	56
PID 2320 wrote to memory of 1132	2320	mscorsvw.exe	57
PID 2320 wrote to memory of 1132	2320	mscorsvw.exe	57
PID 2320 wrote to memory of 1132	2320	mscorsvw.exe	57
PID 2320 wrote to memory of 1988	2320	mscorsvw.exe	58
PID 2320 wrote to memory of 1988	2320	mscorsvw.exe	58
PID 2320 wrote to memory of 1988	2320	mscorsvw.exe	58
PID 2320 wrote to memory of 1996	2320	mscorsvw.exe	59

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	mscorsvw.exe

C:\Users\Admin\AppData\Local\Temp\ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe
"C:\Users\Admin\AppData\Local\Temp\ede5d7fc55e5129f5d6327c1a0edd4209ad377233e715a2fd221aa15e98b5e94.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 164 -NGENProcess 168 -Pipe 174 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 22c -NGENProcess 238 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 218 -NGENProcess 228 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1c0 -NGENProcess 25c -Pipe 218 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 264 -NGENProcess 23c -Pipe 168 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 1fc -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 25c -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1fc -NGENProcess 25c -Pipe 1c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 27c -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 1dc -NGENProcess 274 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 178 -NGENProcess 280 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 284 -NGENProcess 1dc -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 28c -NGENProcess 270 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 270 -NGENProcess 178 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 294 -NGENProcess 1dc -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 28c -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 274 -NGENProcess 1dc -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 298 -NGENProcess 2a0 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 160 -NGENProcess 1dc -Pipe 178 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2a0 -NGENProcess 1dc -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2ac -NGENProcess 294 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 1fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 1dc -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 1dc -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2c8 -NGENProcess 298 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 298 -NGENProcess 2c4 -Pipe 160 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2d4 -NGENProcess 2b4 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2b4 -NGENProcess 2c8 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2cc -NGENProcess 2e4 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2e4 -NGENProcess 2c8 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2ec -NGENProcess 2c4 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2c4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2204
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2c8 -NGENProcess 2ec -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 300 -NGENProcess 2f0 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2a4 -NGENProcess 2bc -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 304 -NGENProcess 298 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 30c -NGENProcess 2ec -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2ec -NGENProcess 2a4 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2a4 -NGENProcess 2f4 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 300 -NGENProcess 310 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 310 -NGENProcess 2ec -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 324 -NGENProcess 2f4 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2bc -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2ec -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2f4 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2bc -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2ec -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 330 -NGENProcess 33c -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 328 -NGENProcess 2ec -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 338 -NGENProcess 330 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 344 -NGENProcess 2f4 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 318 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:2936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 330 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2f4 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 318 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:2540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 330 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 344 -NGENProcess 2f4 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:1376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 324 -NGENProcess 358 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 364 -NGENProcess 350 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:1852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 330 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 350 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 330 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 374 -NGENProcess 370 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2336
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 370 -NGENProcess 354 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:2640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 37c -NGENProcess 36c -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:3056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 364 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:2892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 354 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:1716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 36c -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 364 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 354 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 36c -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 394 -NGENProcess 390 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 384 -NGENProcess 36c -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:1804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 3a0 -NGENProcess 38c -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 388 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 36c -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 38c -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 388 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 36c -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 38c -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3a4 -NGENProcess 388 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:2580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3bc -NGENProcess 3ac -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:2328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c4 -NGENProcess 38c -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 36c -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:1660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3ac -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 38c -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 36c -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3ac -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3c4 -NGENProcess 38c -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d4 -NGENProcess 3b0 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3e4 -NGENProcess 3d0 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3ac -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:2932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 3b0 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 3d0 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e8 -NGENProcess 3f4 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3d0 -NGENProcess 3dc -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3cc -NGENProcess 3fc -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3e4 -NGENProcess 3dc -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 3f8 -NGENProcess 3f0 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3d4 -NGENProcess 3dc -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3dc -NGENProcess 2e4 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 40c -NGENProcess 3d8 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 3d8 -NGENProcess 3d4 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:2560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 3f0 -NGENProcess 418 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 410 -NGENProcess 3d4 -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  PID:1708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent a0 -NGENProcess 3f0 -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent a0 -InterruptEvent 3f8 -NGENProcess 2e4 -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  PID:1256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 41c -NGENProcess 418 -Pipe a4 -Comment "NGen Worker Process"
  2⤵
  PID:2124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 3f0 -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:1132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 420 -NGENProcess 41c -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:1220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 3dc -NGENProcess 3f0 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:2244
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d0 -NGENProcess 3f8 -Pipe 428 -Comment "NGen Worker Process"
  2⤵
  PID:1088
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 42c -NGENProcess a0 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:2912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 434 -NGENProcess 3f0 -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 41c -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:2160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess a0 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:1800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 3f0 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:1108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 41c -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess a0 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:2640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 3f0 -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:1508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 3f0 -NGENProcess 41c -Pipe 450 -Comment "NGen Worker Process"
  2⤵
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 43c -NGENProcess 438 -Pipe 424 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 438 -NGENProcess 44c -Pipe 448 -Comment "NGen Worker Process"
  2⤵
  PID:304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 458 -NGENProcess 41c -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 41c -NGENProcess 43c -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:1748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 460 -NGENProcess 44c -Pipe 138 -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent a0 -NGENProcess 45c -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:1492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent a0 -InterruptEvent 464 -NGENProcess 444 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:2468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 468 -NGENProcess 44c -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 478 -NGENProcess 45c -Pipe 474 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 45c -NGENProcess 464 -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  PID:2628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 480 -NGENProcess 44c -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 44c -NGENProcess 478 -Pipe 47c -Comment "NGen Worker Process"
  2⤵
  PID:936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 488 -NGENProcess 464 -Pipe 468 -Comment "NGen Worker Process"
  2⤵
  PID:2056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 48c -NGENProcess 484 -Pipe 470 -Comment "NGen Worker Process"
  2⤵
  PID:1660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 45c -NGENProcess 478 -Pipe a0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 484 -NGENProcess 478 -Pipe 46c -Comment "NGen Worker Process"
  2⤵
  PID:1020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 498 -NGENProcess 44c -Pipe 494 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 44c -NGENProcess 490 -Pipe 488 -Comment "NGen Worker Process"
  2⤵
  PID:1144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 4a0 -NGENProcess 478 -Pipe 480 -Comment "NGen Worker Process"
  2⤵
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4a4 -NGENProcess 49c -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  PID:2456

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ncjookla.tmp

Filesize
694KB

MD5
1318e3d12b099e219fb295e2e8c9ee8c

SHA1
1082621aaad051f2609a9f4961c6d21eb6a0efd8

SHA256
978db825964aedee3640f2f4339e876ee72b906f86d2291c509869b0af781111

SHA512
af09ca335a63598b8204a2439e0794ec4776cbc4c100dc80f1a269974e23089e651cb604b371eb049a90856ae8d89655d64cc4d4d896a75bc5af90718dae33e8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.6MB

MD5
b83ed6d37bcb4913c1d9e9d2b9879e0c

SHA1
979cd03ccc9d2fb295a58a9d23de20b947426790

SHA256
f1e557037eb58f7f46f836dd28f2911c7c1344fa7238c2e304b25920dad5e0bd

SHA512
b02f27ca0b9855c28d2e1ca26d641f8c537816a4e828cf55eaa05fb189c45c3d987cf70b80086f39bb186a1c0ee2497c93d1f06325a69a6841340fc9c24e1858

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
ca0566ca92aec45df8b358244deb486d

SHA1
6466156f0105bcfa4c2c2ddaf3f5a1e63c64e232

SHA256
3228e1164e842ad4ad3ab948c0a1f4c86aa90954580b8965e6e4a4c197b65ae5

SHA512
cf35cfb22e0329d2fc8607dc6acea6be3eb7950f0f988e3ba6319b679361685f52a5e31c6aadbfe2c5b1b95b8e7ae33ef717681f4bc18acba8a97ca9f861f940

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
636KB

MD5
11c4a47ea71412f1e147fa3256355d41

SHA1
cc1a11cb6259d10e9a647a2b02ea7608f01a8d20

SHA256
947cf155437734cac347cb238368d87d03e36ddbf462af59eb24aa9fc95912ee

SHA512
ac824b6cbb90fed8aa7c4dccd9720d507c1c1fdb35e8b4d6975911925da18c6b8b4e8f59f9c240dd820974f3890416dcb859c5bf51cfed4af8e37bcbe6a457b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
b17366e8da1368a71b42409d7667f26a

SHA1
d4dff79ae4b898df3eb114639aeb8dacd3cdac52

SHA256
334dc90a8a59caca8ac8d1b785f7aaf72169f20fd2a5f1ec82591846252ab4bd

SHA512
faff2bd48e7a92b714f494baa09faf051645b15ef5b1638072b6c306b91ea59d855092655fafe4ea2b502ede89a4cabb9b321147e02f98f7a2897929e03f1c48

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
d528d91500195b2606146b503b73934c

SHA1
0f12aab564b86b8c41638b711ea900e32ffeffc8

SHA256
d026e77cea832f7d96d3adc32bc945eed0de4bffb2b6b20febb67cca441e5632

SHA512
f009e8666da0de47a75334ad634bc6755aefa02387e2b502e51755285e66b608010079e293ef44bf465214cfcc642d2d639150110f1616849108a7da1c886d0d

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
613KB

MD5
7a7d420772eee8742fe779e86b47b496

SHA1
eb97c5c787d52c38f6a8665b6415e3f40c3a9c93

SHA256
2ca217f97f4d4766acd42121df9ab9fd1ac5990fea5940f2cf7e12ac41deebdd

SHA512
ef232accf1484f3124d11014d775249d43e9516da0b8b2d3b83d04a99a8fbb7bf4b0185b5f7a07c941a1cbbb54df4e47de86ccf203557709a8e93e36e4b65f53

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
d8bc217225c662f67aad6e832d11b01b

SHA1
bb78716441dea2bf51bf43ffbf61421ed3788f10

SHA256
9b9a1a25533b2063bd5a339036bc3cecd2ca9f5f88b2ad1c4752d0c498b22a0d

SHA512
6c62eac2d236acb5d1b07cec0c516a42cf8dad96cbb13443d64e42f51173084e8f727fa1aa40c1d41803e790e1e6d45ef7f7a83dddbae77781b5e204e76b5a23

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
644KB

MD5
717851cf87ca1937b0f9b9dda2bd835c

SHA1
fe5d65971171edb3c3c20392261e5169a22452a6

SHA256
244cc1bd9e98a4824b00616dce6ffdc711b69afb96faa8f1e8116e458b45b707

SHA512
d5f557ec66d156781fb4f2af0256db825f0a8aad6e9a53d2d6fd4c089107278f1f1420d580e8bc65adf0bbeacac09853df937f7da242bfa2bf2bce3501099f90

Download Submit
C:\Windows\Temp\Cab5A6F.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar5BD8.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Filesize
91KB

MD5
adc5887e89bc56694a193d92898d3518

SHA1
267f14c45a86d50ad627c6cb00626049e9c1ee20

SHA256
edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b

SHA512
bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4bcd9fc17637e548ceb531332399b9fe\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
66b9f03d219d818f4df73574e78b57cf

SHA1
8c7b45557caf6e9f3ba1b4ba85db0cd2068968b8

SHA256
c815ecbbe091b2602a3c238794dd4a40e971d92461f0e8d99f6058487f352679

SHA512
40d77769be1fb9618a20cdee15ebaf01914a82909edceae5b1ba37a5a15d61a9ff3f3324428e5a4f7586a876438652a457f26065f38f45e6119eeb226c285477

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\505a742c0a1a436390cea57b523f7f2c\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
633bbf5edabf0fd2a6be55bc44289277

SHA1
22d8ffd6353585c49f27f8ad5192b0c08ed5da40

SHA256
901e411b35ecfdb794fb953c8b8fd4c3a2ed2b682d472841d3ed48bfc98686a2

SHA512
96678fb195bddfb5bf6d0fb30def30cb20e285bffd30968590a8bc3d90c92a57d1e1c7ddccb1cca520ac68efbaa4d3832601fe7a6f7bbfe3f1dc1143bcc115e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Filesize
1.8MB

MD5
04a6857c04546270358d14398fde209e

SHA1
596a3e11ac6c303c679edfd6c30aa71e8eaf8a23

SHA256
8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285

SHA512
4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Filesize
381KB

MD5
0811b25e0449e04f782127bc6f8ac5e3

SHA1
dc1766e20ee338b12fa80e3ce0052ef97ddf9e20

SHA256
20d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c

SHA512
a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\74054b5793bfb8c8c0753b4d4aead8e3\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll

Filesize
947KB

MD5
b1aa17d171be82960213057ca35815a9

SHA1
6c68a8a2c524ddbe04395dfa613378bb311aa314

SHA256
c632156c276f9189d0f53addcc1043006d86188e3b74d9c4042ab2110b6cfd4e

SHA512
6f042aec9c74da86d15322d4300d93e4a9e69ad3555b302d42d7629dfa060209898b4569a380e9da1a785ddb53a6e0cc0f7543606f17ee467277990971c2fc1a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Filesize
483KB

MD5
aae5a97685a809d0a0f661f9319f8a12

SHA1
b5fdd4ec4cc057fccc868de4f4910be89e23e48a

SHA256
c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233

SHA512
d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\aa7af91f5026faa7eb759a0acbf9c33a\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
4826878401ac12fd69f866f0dea55b17

SHA1
d975d528ff960e1749c78ea26ef4f8bc4fe8dd12

SHA256
ef22edcb6c8b6247328188eaaf9714d86a37351de0586a7641fe1e29632ead67

SHA512
16794f687c6c810be4a95c63edeb362e10109827d919b63ef8d3cbc49b708a46ae24d9f4620b2273c20c0eabd88a0fa555248e2fc383d2771a7a19581a069bb8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\daa561280ac1119d9c2694442212aaea\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll

Filesize
487KB

MD5
aefa28d036740086ae52d157f245200a

SHA1
d502f55fa76c3cdb69c8ab97321cd9b9a4b68e55

SHA256
75127c1e3a30e544413d7eb24fd726bacf8c3a3951ddba1fc990ad00a7f1cc49

SHA512
3943c099644525fc2b3a50f843cc1612a003d4f92a9187b2fcecaaf90b33071bced0db4608a91bb59c6bf5d1f6f4eb158881bf78cced0597b7bc3045d9b66ee3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\e8c1478a907701044f6ba226cbb0a44b\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
153c7f19d24746962697ecbf62623fea

SHA1
3851e51f0733cb7701a580317a4d55b067830fd6

SHA256
3b76f5ed9c3ae4a92fd9a207387a038827e5d455a1530d4332ba8293f289f04c

SHA512
a69ae437fd836d6c1bbe8b5f005287502d182a8ebd512aef0812c4348fb3af5b061c8cd7faea59efd8698de423ab22cb67880fd58b063c8ac832343330a77874

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
694KB

MD5
4422e43144f998433b25e048e827d534

SHA1
c8021c03503fcc4a1f006d4731ced595ed3fd442

SHA256
29e7a03ca72e364d08ff794ca9de70751852a6602987917f7e731139df5c1f28

SHA512
470bf53ae3831ebb4727737480b61747a29c725c709ba3fef5f146298013929d2e811bb135148aa6850d32fdb6b72f58e48946050363b2ef531103d7947d1f3d

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
e71da416d6d9d1983139980150b1494f

SHA1
36f9d6af6d8bc2cf28f6c0686050dabf214f55f8

SHA256
47a88b002054a913aa362f96c917f7980fa6657ad504f5862f95e769cc21413d

SHA512
d2bff64f971ff983af702b0b9464a57b90eb59ff020d88ce900b050834d724baff642f43a4e16c68d4870c8ab99958b87827c4eced34c754eec20ab00cd342e6

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
769KB

MD5
0bdfb2e6ef79d306103c363bcabc25e2

SHA1
5de8b32328497eb9db118b4837ce92afb534753f

SHA256
db718bc9636c7a98a3283b47f618f6841086eafcf3168d0478b33801796b8089

SHA512
0b477fc6f32940eddb1852800b718aae578f5d9db30d971f6f97c92ab19946948283c3e9f4f8d4565827d4b57c6a7d7a288ef45540c5209ab99de51c5c54bedd

Download Submit
\??\c:\program files\windows media player\wmpnetwk.exe

Filesize
2.0MB

MD5
ed5bf2ef6378d782560ebef22646bfcf

SHA1
2a02978601effe0a739c43bb94d65d9c27984d67

SHA256
b8d1d52f5e5edb5181d324e9d20b8ad99540938c98da0f3fbb0bebafe2342905

SHA512
b1924f8ab5f28edd2644853ec8cd8f3edbff53e945d1ef106d91c4b7637a13f432759fed26ee322d7f73b74e07dbce57b3ea192552dd6f5535ccab58cd6add19

Download Submit
\??\c:\windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
ea802d3a54b6b697dcab22a058afe383

SHA1
e3dc7565cea2075dbbf7348ecd8df31300580432

SHA256
1d74c650eef90b26961917d8bfc27b0c06827c3e7c5007b2e62d31390bdbaa7f

SHA512
bbd49ec7d9c702583f66d9e2121cac1be70ebc7b7084f77fb7be71ae781a10c157ac958edabaa3464647e67430a769a6ac069e95df922664256e47d0fbff367d

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
679KB

MD5
97c2b306a6d50bf6988f8aa6a53ee385

SHA1
a19b34b3d4e054268489a32873e6b43752d0f197

SHA256
95a9fcbdf44d97e5c4237de76cedc76aa65768741c4fd56095e084f40d50c434

SHA512
cc0e1c75267378c11731d082ce789ef42682f27329e78dcfb6e43125b651e8be76dcb41b3b25d03cde9e41bdb9985b3bfa33d8dc7875001197b47a5cc6930b41

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
591KB

MD5
7cd571ccc8e550b417e83cc90491f23d

SHA1
d02351fc89f4622c602440b77bbb0315a863c2d9

SHA256
66cd47dee4d94bbf3c715079aa472bee6d281735b2cd8b6841a4b0bab83b4fb8

SHA512
8799c44049bd3e0f810a5207d76edb11b1ac4e999a8251984c5b68775dd927fd7f750fedd1f7c7e23b4c3e76cdd6d0f0e369097c975a771659293feedf640c37

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
632KB

MD5
78afc836cc6d89525430f7d4406011a7

SHA1
5b3cd067ade07569116398cb93e21cc011532cef

SHA256
b5b1eafa58129b919b10b2e94416d26f56e380f58543109ecfa5f66137aed854

SHA512
6678aea2a6bc03c7ba4033891753bc34c6af9b51dc1ec916a5db0f87ee38bd45efe9425a68ff230116b3660a7c8efd50261007c0050fcb4f2c515989afe60f40

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
7e24869014a95a9133b2ea62b6fd50ea

SHA1
998e81a686069d61093911c9972f5ed33763c636

SHA256
41206157ed25abf1b25a098990fe275ea7a75ff3ed200a888fb3fbba2cbe0728

SHA512
b7208b46c032eba8a74cc1817a37f9e241754ee32b04c55f3a1d34f79c337a2d0a4ce379de36f127f4cdee6327de48c5d7d380bc782d036a70bf4b849218494c

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
693KB

MD5
ef9fb754e3ecc5d377baa3c42ac81bf5

SHA1
8eccb327b884e089c17ff7f5b920576e230336d7

SHA256
26373353b5002e586ee1589937d58c40df52505e1741c0aba6d61cff3aa84d25

SHA512
522e1667fb12ba91355a3bdd26edd52694780ca6f8d7e26af661db09bab7145ac2da1581cf3c21526c98bace8c2dd152445c16d008ab1cc94f7d2f6b463eda4e

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
679KB

MD5
de87b44411faec4ac27eedfa69147058

SHA1
a587598983d86d54f1a3986d64a4182095cb350a

SHA256
7f05bcd2c4f7033bcaafeeb32859099e2823f5e7d5984cf3dc5bbc28a05d7227

SHA512
9cb5b3142acc9c1db1904b9f05d421e3d435727361c8bdb2748d265ee0118cd9445c5d8a171fe02792e40d37252ea1cc36e620b4baf78e99e61687b9b3fa1112

Download Submit
\??\c:\windows\system32\searchindexer.exe

Filesize
1.1MB

MD5
cf5b07b2d3a37fed3faf8f7b48aaa8db

SHA1
4bfd3b34672359c5e4166af1e00345efdcdd17f4

SHA256
928dfb3a0bb9573f82367d0b9d66cbbaa63a56e3ae3ac08e42429e42e378c4a3

SHA512
c01cd28a8d3876cf3cccf687909011ce9ed79df9f3d6c996deba049e30cab63a1926c8fd201795f4b335c15f205928c0031c5cdfa019e52f06ff220ce3ac588d

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
569KB

MD5
2ab53b619be4da04345fabe1a886531b

SHA1
14c83da54823b5d1d8a2d3eb0e2c04641c25f1a7

SHA256
79cd6a6d5a591396722c3c12459aca841b7926c4e143bea472a5c7c930462bca

SHA512
cf9727a332b932515f380298bbacc1ae57c7ad6e8df74487b368706117dcf33d5db1c5b2d07452b9e297272b6de8f997e10c4e6b45346a40008056bd53db30af

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
595KB

MD5
90204416debe0f9e5835dc51aa0034ac

SHA1
c89f1919f437906b08cb25e3047e7c276f817e9f

SHA256
0d160f1fc41b4be375257fca0425990c75d7755fd5b75bff10554fe74b3a7556

SHA512
0ffb2c92a83af623f01678402fc20d52a782685560505cc1d3200c57a0935f129c68be33cb697fa7e10d229ceada179c213a6536e48ad223ec1eec6caf76f981

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.1MB

MD5
fdac18d1a6e36d24ce0c693cf9d0122b

SHA1
01bb5b9f66b3957446f9f704ae4f50998009ace3

SHA256
7b5fb0b6f7604e70f7e473e48b9a68adb50bb295230e63f8666fca29de18fb30

SHA512
87ec95987763941453d0b16c221b9b9964aa9c6a7f04b5b784ce8fbab27fc00f240c5123198b09e3be4e07c985475fe072d75414f38364a4a52752ca181e53da

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.1MB

MD5
b753b45dfebad0f465d63f43bf551d51

SHA1
dde1b8e99dff109b0116e33bbb40b0f4fd6da73b

SHA256
dd6bd52db553c6f29a9e2e2d5d5d20f8e409485ab7af3fcd3cb98c8d4bbb6ab9

SHA512
6a8d36ed02f805caee816f60091e2fdee48f02766d2fdfb034f3a4b2d4227460d67bd72b578554da0d447756de0332de57794369b212cae74d3b90569a09dbf7

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
753KB

MD5
8f647fbbba971ac31b01a58c612b0b1f

SHA1
732f4a76ce5f296957bfe0064406109d9a0eb981

SHA256
b80c28d86804e19a78b25d47275b595c6c6a90e267ba8f04dfc83ade867dc9c3

SHA512
9c8338cdcaa0c46cb7eff2ed8976d86a03bf47be0e39c50724af31759c5f6d036c8f876186d24545ef1e6420077d421074d2b68ec82edd94576b90e18ed7d828

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.0MB

MD5
e653ce4dfeeea096ab82fd1fe1dd5801

SHA1
d9a9d68a0403793eca4cd736ea8b1a61a7723728

SHA256
bdf7c365019cf2966df385880d69c14cdd09514b7fbac8805fadc2fd3ca0a0c8

SHA512
2ddbd1ae12d2b673f882a3fdb33f9f6c83da274a688edb121ee86873c35c702c46950f6292c110ab12500ee0157d766e6e15bfaa4ddc81374dc27ef39c99d67a

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
8c7108370227b9a329fee4b6a664e234

SHA1
88c20a13d9f5f2ed16c20e36f04549b6f0928b1b

SHA256
484589e32e143c9d608f4353433a813a3c51d7f226b8d278cc490a4802ba9926

SHA512
7446c594ffc55b26e989b465b2df64257b940405b8032e5328381a76088b40f1f7110d5e1601e0dbd40a32382d064c49861fa910844a396f94a86c13e8ad80a7

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
666KB

MD5
a89c08a33705b1e8893a849ef967ec34

SHA1
993b49a5b6ac0b5e9e02d431d48cb72161ba02ee

SHA256
944a64f4cb2bc73bb146bf71ad4a86624d293c9c5aa4b052947847d61b44ff50

SHA512
621b5503f04de9f876e59bd21677130252a06b556aea5c418052ab743ed98da12d636dfc0f4dff59e68b866b9b78f0849c268bd6002a71ac6868e34c843ab45b

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPEDA9.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF048.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF383.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF7B7.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPFA85.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
memory/108-61-0x0000000010000000-0x0000000010200000-memory.dmp

Filesize
2.0MB

Download
memory/108-60-0x0000000010000000-0x0000000010200000-memory.dmp

Filesize
2.0MB

Download
memory/108-117-0x0000000010000000-0x0000000010200000-memory.dmp

Filesize
2.0MB

Download
memory/316-323-0x00000000008E0000-0x00000000008F4000-memory.dmp

Filesize
80KB

Download
memory/316-325-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/316-320-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/316-322-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download
memory/1352-252-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/1352-261-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/1352-246-0x0000000003110000-0x0000000003158000-memory.dmp

Filesize
288KB

Download
memory/1352-251-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/1352-247-0x000000001C4D0000-0x000000001C4E6000-memory.dmp

Filesize
88KB

Download
memory/1352-244-0x00000000030B0000-0x00000000030BE000-memory.dmp

Filesize
56KB

Download
memory/1352-245-0x0000000003100000-0x000000000310C000-memory.dmp

Filesize
48KB

Download
memory/1440-338-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/1440-339-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/1440-343-0x00000000031C0000-0x00000000031DA000-memory.dmp

Filesize
104KB

Download
memory/1440-344-0x00000000031C0000-0x00000000031DA000-memory.dmp

Filesize
104KB

Download
memory/1484-178-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1484-207-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1484-72-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1484-73-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/1736-274-0x00000000031A0000-0x00000000031E8000-memory.dmp

Filesize
288KB

Download
memory/1736-276-0x00000000031F0000-0x000000000320E000-memory.dmp

Filesize
120KB

Download
memory/1736-293-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/1736-284-0x000000001D1C0000-0x000000001D1D8000-memory.dmp

Filesize
96KB

Download
memory/1736-283-0x000000001D1C0000-0x000000001D1D8000-memory.dmp

Filesize
96KB

Download
memory/1736-275-0x0000000000870000-0x000000000088A000-memory.dmp

Filesize
104KB

Download
memory/1736-273-0x0000000000850000-0x0000000000866000-memory.dmp

Filesize
88KB

Download
memory/1736-270-0x00000000007C0000-0x00000000007D8000-memory.dmp

Filesize
96KB

Download
memory/1736-271-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/1736-272-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/1916-331-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2072-224-0x0000000140000000-0x0000000140208000-memory.dmp

Filesize
2.0MB

Download
memory/2072-208-0x0000000140000000-0x0000000140208000-memory.dmp

Filesize
2.0MB

Download
memory/2072-120-0x0000000140000000-0x0000000140208000-memory.dmp

Filesize
2.0MB

Download
memory/2112-334-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/2112-332-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2112-333-0x00000000007C0000-0x00000000007DA000-memory.dmp

Filesize
104KB

Download
memory/2112-336-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2164-233-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2164-230-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2244-105-0x0000000010000000-0x00000000101CD000-memory.dmp

Filesize
1.8MB

Download
memory/2244-49-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2244-47-0x0000000010000000-0x00000000101CD000-memory.dmp

Filesize
1.8MB

Download
memory/2320-86-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2320-182-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2340-112-0x0000000140000000-0x0000000140391000-memory.dmp

Filesize
3.6MB

Download
memory/2400-306-0x0000000000850000-0x0000000000860000-memory.dmp

Filesize
64KB

Download
memory/2400-305-0x0000000003110000-0x000000000312A000-memory.dmp

Filesize
104KB

Download
memory/2400-304-0x00000000032E0000-0x0000000003328000-memory.dmp

Filesize
288KB

Download
memory/2400-310-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2400-311-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2400-303-0x0000000000A00000-0x0000000000A16000-memory.dmp

Filesize
88KB

Download
memory/2400-321-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2400-302-0x0000000000840000-0x000000000084E000-memory.dmp

Filesize
56KB

Download
memory/2400-301-0x0000000000830000-0x000000000083C000-memory.dmp

Filesize
48KB

Download
memory/2400-300-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2468-183-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2468-211-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2508-262-0x00000000007E0000-0x00000000007F8000-memory.dmp

Filesize
96KB

Download
memory/2508-264-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/2508-265-0x0000000003040000-0x000000000305A000-memory.dmp

Filesize
104KB

Download
memory/2508-268-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2508-266-0x000000001C740000-0x000000001C75E000-memory.dmp

Filesize
120KB

Download
memory/2808-298-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2808-294-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2808-296-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/2848-236-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2864-228-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2864-231-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/3000-212-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/3000-210-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/3036-242-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/3036-239-0x0000000000A50000-0x0000000000A98000-memory.dmp

Filesize
288KB

Download
memory/3036-238-0x00000000007F0000-0x00000000007FC000-memory.dmp

Filesize
48KB

Download
memory/3036-237-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/3036-240-0x0000000000890000-0x00000000008A6000-memory.dmp

Filesize
88KB

Download
memory/3036-235-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/3052-48-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-11-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-46-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-0-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-31-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-30-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-29-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-28-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-12-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-221-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-7-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-6-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-5-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-3-0x0000000000390000-0x00000000003D8000-memory.dmp

Filesize
288KB

Download
memory/3052-4-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-2-0x0000000140000000-0x0000000140329000-memory.dmp

Filesize
3.2MB

Download
memory/3052-1-0x0000000140033000-0x0000000140034000-memory.dmp

Filesize
4KB

Download