Analysis
-
max time kernel
34s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/10/2024, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe
Resource
win7-20240903-en
General
-
Target
2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe
-
Size
3.2MB
-
MD5
9fecfd4c3d7862921a2e06b026a3d5d3
-
SHA1
04c5e957c96c7a8c61ecf850ec7830ab9baf68d3
-
SHA256
4eca1b53f9a34ff31976a838231c91360bfb48175d60cc168c341017d955903f
-
SHA512
91e7cb9af7e52c928b03db69a92d216531809458fc2eac12e5a760f1336182ea2202d5f54e803e481b56de8711e1f1ae1f7010072f116a0b16cf9619ceabcf1d
-
SSDEEP
49152:D5k1YCdptya507NUUWn043oHS3fTGYwVq1/xT3DDbwwTU+ete30jaNf1TWbdz:XNhSqYw8OlU023W
Malware Config
Signatures
-
Executes dropped EXE 53 IoCs
pid Process 472 Process not Found 2716 aspnet_state.exe 2764 mscorsvw.exe 3040 mscorsvw.exe 1740 mscorsvw.exe 2020 mscorsvw.exe 2348 ehRecvr.exe 1420 ehsched.exe 1932 elevation_service.exe 1996 IEEtwCollector.exe 2156 GROOVE.EXE 864 maintenanceservice.exe 2892 msdtc.exe 2512 msiexec.exe 2756 OSE.EXE 2352 perfhost.exe 864 locator.exe 3140 snmptrap.exe 3232 vds.exe 3332 vssvc.exe 3420 wbengine.exe 3540 WmiApSrv.exe 3636 wmpnetwk.exe 3744 SearchIndexer.exe 3448 chrmstp.exe 3664 chrmstp.exe 3940 chrmstp.exe 3908 mscorsvw.exe 3648 chrmstp.exe 4040 mscorsvw.exe 3348 mscorsvw.exe 3600 mscorsvw.exe 2132 mscorsvw.exe 3344 mscorsvw.exe 3148 mscorsvw.exe 3600 mscorsvw.exe 3120 mscorsvw.exe 3156 mscorsvw.exe 3240 mscorsvw.exe 3244 mscorsvw.exe 4028 mscorsvw.exe 2080 mscorsvw.exe 3864 mscorsvw.exe 2452 mscorsvw.exe 3340 mscorsvw.exe 3580 mscorsvw.exe 3488 mscorsvw.exe 3248 mscorsvw.exe 4036 mscorsvw.exe 3844 mscorsvw.exe 3412 mscorsvw.exe 4276 mscorsvw.exe 4368 mscorsvw.exe -
Loads dropped DLL 13 IoCs
pid Process 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 2512 msiexec.exe 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 748 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 19 IoCs
description ioc Process File opened for modification C:\Windows\system32\msiexec.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\System32\alg.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ab9ac66b8464adf2.bin mscorsvw.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\System32\alg.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{9DFE08CC-30AD-4427-BBD2-AE53EED44C59}\chrome_installer.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe -
Drops file in Windows directory 27 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GROOVE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft ehRecvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie ehRecvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia SearchFilterHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" ehRec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070454ed79223db01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" ehRec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009077b2d59223db01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-142 = "Wildlife" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" ehRec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000907468d79223db01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-108 = "Penguins" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-107 = "Lighthouse" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090618cd59223db01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-118 = "Sleep Away" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{A2858309-BA61-4BC1-B4D5-A28864286595} wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-105 = "Koala" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1852 chrome.exe 1852 chrome.exe 2948 ehRec.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3008 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe Token: SeShutdownPrivilege 1740 mscorsvw.exe Token: SeShutdownPrivilege 2020 mscorsvw.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: 33 568 EhTray.exe Token: SeIncBasePriorityPrivilege 568 EhTray.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeRestorePrivilege 2512 msiexec.exe Token: SeTakeOwnershipPrivilege 2512 msiexec.exe Token: SeSecurityPrivilege 2512 msiexec.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeDebugPrivilege 2948 ehRec.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeBackupPrivilege 3332 vssvc.exe Token: SeRestorePrivilege 3332 vssvc.exe Token: SeAuditPrivilege 3332 vssvc.exe Token: SeBackupPrivilege 3420 wbengine.exe Token: SeRestorePrivilege 3420 wbengine.exe Token: SeSecurityPrivilege 3420 wbengine.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1740 mscorsvw.exe Token: SeShutdownPrivilege 2020 mscorsvw.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: 33 568 EhTray.exe Token: SeIncBasePriorityPrivilege 568 EhTray.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1740 mscorsvw.exe Token: SeShutdownPrivilege 1740 mscorsvw.exe Token: SeShutdownPrivilege 2020 mscorsvw.exe Token: SeShutdownPrivilege 2020 mscorsvw.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeManageVolumePrivilege 3744 SearchIndexer.exe Token: 33 3744 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3744 SearchIndexer.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: 33 3636 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 3636 wmpnetwk.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 2020 mscorsvw.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeDebugPrivilege 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe Token: SeDebugPrivilege 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe Token: SeDebugPrivilege 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe Token: SeDebugPrivilege 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe Token: SeDebugPrivilege 2524 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe 3576 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2524 3008 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 30 PID 3008 wrote to memory of 2524 3008 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 30 PID 3008 wrote to memory of 2524 3008 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 30 PID 3008 wrote to memory of 1852 3008 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 31 PID 3008 wrote to memory of 1852 3008 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 31 PID 3008 wrote to memory of 1852 3008 2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe 31 PID 1852 wrote to memory of 2740 1852 chrome.exe 32 PID 1852 wrote to memory of 2740 1852 chrome.exe 32 PID 1852 wrote to memory of 2740 1852 chrome.exe 32 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 2408 1852 chrome.exe 37 PID 1852 wrote to memory of 1948 1852 chrome.exe 38 PID 1852 wrote to memory of 1948 1852 chrome.exe 38 PID 1852 wrote to memory of 1948 1852 chrome.exe 38 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 PID 1852 wrote to memory of 1780 1852 chrome.exe 39 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=92.0.4515.159 --initial-client-data=0x180,0x184,0x188,0x17c,0x18c,0x140221ee0,0x140221ef0,0x140221f002⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6f19758,0x7fef6f19768,0x7fef6f197783⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:23⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:13⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:13⤵PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1568 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:23⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2912 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1436 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:13⤵PID:1184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2668 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:2052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4036 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:3372
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵
- Executes dropped EXE
PID:3448 -
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x184,0x188,0x18c,0x180,0x190,0x1403b7688,0x1403b7698,0x1403b76a84⤵
- Executes dropped EXE
PID:3664
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
- Executes dropped EXE
PID:3940 -
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x184,0x188,0x18c,0x180,0x190,0x1403b7688,0x1403b7698,0x1403b76a85⤵
- Executes dropped EXE
PID:3648
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:3076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:3156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3928 --field-trial-handle=1352,i,5356357403457530536,13806959037470092501,131072 /prefetch:83⤵PID:1520
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
PID:2716
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2764
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3040
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 254 -NGENProcess 258 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 2d4 -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2d8 -NGENProcess 2d0 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2dc -NGENProcess 2cc -Pipe 2d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3344
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2ec -NGENProcess 254 -Pipe 2e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3148
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2f4 -NGENProcess 2ec -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2d4 -NGENProcess 2d0 -Pipe 2cc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3120
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e4 -NGENProcess 2f0 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3156
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2f8 -NGENProcess 2ec -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2d0 -Pipe 2dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 304 -NGENProcess 2f0 -Pipe 300 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4028
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 30c -NGENProcess 268 -Pipe 308 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2080
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2e4 -NGENProcess 2fc -Pipe 2f4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2ec -NGENProcess 30c -Pipe 2d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2d0 -NGENProcess 2c8 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 314 -NGENProcess 2fc -Pipe 2f8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 2ec -NGENProcess 31c -Pipe 2d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 30c -NGENProcess 320 -Pipe 318 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 304 -NGENProcess 31c -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 324 -NGENProcess 310 -Pipe 2fc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 2c8 -NGENProcess 31c -Pipe 2e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3412
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 32c -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 30c -NGENProcess 304 -Pipe 334 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4368
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1272
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3908
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 1dc -NGENProcess 1e4 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:4040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 150 -InterruptEvent 1a4 -NGENProcess 184 -Pipe 194 -Comment "NGen Worker Process"2⤵PID:3840
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a4 -InterruptEvent 1f8 -NGENProcess 1e0 -Pipe 1f4 -Comment "NGen Worker Process"2⤵PID:4188
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 1fc -NGENProcess 1c4 -Pipe 1f0 -Comment "NGen Worker Process"2⤵PID:4316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 1a4 -NGENProcess 204 -Pipe 1f8 -Comment "NGen Worker Process"2⤵PID:4392
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a4 -InterruptEvent 164 -NGENProcess 1c4 -Pipe 1a8 -Comment "NGen Worker Process"2⤵PID:4444
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 1c4 -NGENProcess 200 -Pipe 1e0 -Comment "NGen Worker Process"2⤵PID:4560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 210 -InterruptEvent 204 -NGENProcess 214 -Pipe 208 -Comment "NGen Worker Process"2⤵PID:4008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 164 -NGENProcess 218 -Pipe 210 -Comment "NGen Worker Process"2⤵PID:4760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 164 -NGENProcess 1ec -Pipe 214 -Comment "NGen Worker Process"2⤵PID:4836
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 218 -InterruptEvent 21c -NGENProcess 1ec -Pipe 150 -Comment "NGen Worker Process"2⤵PID:4960
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 1fc -NGENProcess 220 -Pipe 1c4 -Comment "NGen Worker Process"2⤵PID:5048
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 220 -NGENProcess 218 -Pipe 164 -Comment "NGen Worker Process"2⤵PID:3460
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 22c -NGENProcess 200 -Pipe 204 -Comment "NGen Worker Process"2⤵PID:1520
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1fc -NGENProcess 230 -Pipe 220 -Comment "NGen Worker Process"2⤵PID:2684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 21c -NGENProcess 200 -Pipe 20c -Comment "NGen Worker Process"2⤵PID:2976
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 200 -NGENProcess 1ec -Pipe 22c -Comment "NGen Worker Process"2⤵PID:3600
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 234 -NGENProcess 240 -Pipe 21c -Comment "NGen Worker Process"2⤵PID:3264
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 240 -NGENProcess 184 -Pipe 1ec -Comment "NGen Worker Process"2⤵PID:3508
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 230 -NGENProcess 238 -Pipe 200 -Comment "NGen Worker Process"2⤵PID:3268
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 228 -NGENProcess 248 -Pipe 240 -Comment "NGen Worker Process"2⤵PID:4248
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 24c -NGENProcess 238 -Pipe 244 -Comment "NGen Worker Process"2⤵PID:4188
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 228 -NGENProcess 234 -Pipe 184 -Comment "NGen Worker Process"2⤵PID:4488
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 230 -NGENProcess 23c -Pipe 1fc -Comment "NGen Worker Process"2⤵PID:4568
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 23c -NGENProcess 24c -Pipe 238 -Comment "NGen Worker Process"2⤵PID:3920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 258 -NGENProcess 234 -Pipe 224 -Comment "NGen Worker Process"2⤵PID:4640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 234 -NGENProcess 230 -Pipe 254 -Comment "NGen Worker Process"2⤵PID:4684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 260 -NGENProcess 24c -Pipe 228 -Comment "NGen Worker Process"2⤵PID:1204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 24c -NGENProcess 258 -Pipe 25c -Comment "NGen Worker Process"2⤵PID:4968
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 268 -NGENProcess 230 -Pipe 23c -Comment "NGen Worker Process"2⤵PID:3432
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 230 -NGENProcess 260 -Pipe 264 -Comment "NGen Worker Process"2⤵PID:4084
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 270 -NGENProcess 258 -Pipe 234 -Comment "NGen Worker Process"2⤵PID:1984
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 258 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"2⤵PID:3476
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 278 -NGENProcess 260 -Pipe 24c -Comment "NGen Worker Process"2⤵PID:2080
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"2⤵PID:4912
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 280 -NGENProcess 268 -Pipe 230 -Comment "NGen Worker Process"2⤵PID:2000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 278 -NGENProcess 288 -Pipe 260 -Comment "NGen Worker Process"2⤵PID:4288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 248 -NGENProcess 268 -Pipe 258 -Comment "NGen Worker Process"2⤵PID:2652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 268 -NGENProcess 280 -Pipe 290 -Comment "NGen Worker Process"2⤵PID:4592
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 280 -NGENProcess 27c -Pipe 294 -Comment "NGen Worker Process"2⤵PID:4668
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 250 -NGENProcess 218 -Pipe 270 -Comment "NGen Worker Process"2⤵PID:2196
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 284 -NGENProcess 248 -Pipe 29c -Comment "NGen Worker Process"2⤵PID:1036
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 248 -NGENProcess 280 -Pipe 298 -Comment "NGen Worker Process"2⤵PID:4864
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2a0 -NGENProcess 2a4 -Pipe 284 -Comment "NGen Worker Process"2⤵PID:4816
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 278 -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"2⤵PID:5044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2a0 -NGENProcess 248 -Pipe 288 -Comment "NGen Worker Process"2⤵PID:5060
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 218 -NGENProcess 2a8 -Pipe 250 -Comment "NGen Worker Process"2⤵PID:3484
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 218 -InterruptEvent 2b0 -NGENProcess 280 -Pipe 268 -Comment "NGen Worker Process"2⤵PID:1492
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2b4 -NGENProcess 248 -Pipe 28c -Comment "NGen Worker Process"2⤵PID:4696
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2b8 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"2⤵PID:1856
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2bc -NGENProcess 280 -Pipe 278 -Comment "NGen Worker Process"2⤵PID:940
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 280 -NGENProcess 2b0 -Pipe 2c4 -Comment "NGen Worker Process"2⤵PID:4040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a0 -NGENProcess 2c0 -Pipe 218 -Comment "NGen Worker Process"2⤵PID:3632
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 2b4 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:4072
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2b4 -NGENProcess 2b8 -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1144
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 2b4 -NGENProcess 2c0 -Pipe 2a4 -Comment "NGen Worker Process"2⤵PID:3876
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2a8 -NGENProcess 2b8 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:3956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2d8 -NGENProcess 2bc -Pipe 280 -Comment "NGen Worker Process"2⤵PID:4100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2bc -NGENProcess 248 -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:4384
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 248 -NGENProcess 2dc -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:4368
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 2c8 -NGENProcess 2d4 -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:4428
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e8 -NGENProcess 2d8 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:4664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2dc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:4584
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2d4 -Pipe 2b4 -Comment "NGen Worker Process"2⤵PID:796
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2d8 -Pipe 2bc -Comment "NGen Worker Process"2⤵PID:4708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2dc -Pipe 248 -Comment "NGen Worker Process"2⤵PID:1348
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2d4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:4932
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2d8 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:5000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2dc -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:5044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 300 -NGENProcess 2d4 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:4000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f0 -NGENProcess 308 -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:2220
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 30c -NGENProcess 2dc -Pipe 314 -Comment "NGen Worker Process"2⤵PID:1400
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2a8 -NGENProcess 310 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:1080
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 318 -NGENProcess 308 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:1856
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2dc -Pipe 304 -Comment "NGen Worker Process"2⤵PID:4028
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 310 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:4040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 320 -NGENProcess 31c -Pipe 308 -Comment "NGen Worker Process"2⤵PID:336
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 2f0 -NGENProcess 310 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:4112
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 32c -NGENProcess 318 -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:4228
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 31c -Pipe 328 -Comment "NGen Worker Process"2⤵PID:4044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 310 -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:4464
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 318 -NGENProcess 330 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:1424
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 330 -NGENProcess 338 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:2652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 33c -NGENProcess 340 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:4644
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 348 -NGENProcess 310 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:2284
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 338 -Pipe 2f0 -Comment "NGen Worker Process"2⤵PID:3100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 340 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:2464
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 310 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:4972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 348 -NGENProcess 338 -Pipe 35c -Comment "NGen Worker Process"2⤵PID:1204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 330 -NGENProcess 358 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:1700
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 354 -NGENProcess 364 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:3136
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 31c -NGENProcess 358 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:5060
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 360 -NGENProcess 36c -Pipe 354 -Comment "NGen Worker Process"2⤵PID:868
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 340 -NGENProcess 358 -Pipe 350 -Comment "NGen Worker Process"2⤵PID:768
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 374 -NGENProcess 31c -Pipe 370 -Comment "NGen Worker Process"2⤵PID:3240
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 364 -NGENProcess 31c -Pipe 360 -Comment "NGen Worker Process"2⤵PID:1432
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 338 -NGENProcess 340 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:2656
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 358 -NGENProcess 37c -Pipe 330 -Comment "NGen Worker Process"2⤵PID:3476
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 310 -NGENProcess 384 -Pipe 338 -Comment "NGen Worker Process"2⤵PID:936
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 378 -NGENProcess 37c -Pipe 31c -Comment "NGen Worker Process"2⤵PID:2948
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 374 -NGENProcess 38c -Pipe 310 -Comment "NGen Worker Process"2⤵PID:1992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 368 -NGENProcess 37c -Pipe 380 -Comment "NGen Worker Process"2⤵PID:2944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 37c -NGENProcess 388 -Pipe 378 -Comment "NGen Worker Process"2⤵PID:4528
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 394 -NGENProcess 38c -Pipe 340 -Comment "NGen Worker Process"2⤵PID:2412
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 38c -NGENProcess 368 -Pipe 390 -Comment "NGen Worker Process"2⤵PID:4848
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 39c -NGENProcess 388 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 358 -NGENProcess 398 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:4708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 364 -NGENProcess 358 -Pipe a0 -Comment "NGen Worker Process"2⤵PID:5020
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 358 -NGENProcess 9c -Pipe 384 -Comment "NGen Worker Process"2⤵PID:5032
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 394 -NGENProcess 368 -Pipe 398 -Comment "NGen Worker Process"2⤵PID:3860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3a8 -NGENProcess 3a0 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 9c -Pipe 38c -Comment "NGen Worker Process"2⤵PID:3288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 368 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:1976
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 3a0 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:1856
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3ac -NGENProcess 3bc -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:1860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 9c -NGENProcess 3c0 -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:4196
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3a0 -NGENProcess 3c4 -Pipe 358 -Comment "NGen Worker Process"2⤵PID:4104
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 37c -NGENProcess 3c0 -Pipe 368 -Comment "NGen Worker Process"2⤵PID:4136
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 3cc -NGENProcess 9c -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:4252
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d4 -NGENProcess 3ac -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:3956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3dc -NGENProcess 3a8 -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:4304
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3a8 -NGENProcess 3bc -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:844
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3c4 -NGENProcess 394 -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:4100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3c4 -NGENProcess 3e0 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:1344
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3a0 -NGENProcess 3c0 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:4560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3a0 -NGENProcess 3a8 -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:3704
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3a0 -NGENProcess 3bc -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:4680
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3bc -NGENProcess 134 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:5076
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3f8 -NGENProcess 394 -Pipe 3f4 -Comment "NGen Worker Process"2⤵PID:4972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 404 -NGENProcess 3f8 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:4992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 3cc -NGENProcess 3a0 -Pipe 3f0 -Comment "NGen Worker Process"2⤵PID:5004
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 408 -NGENProcess 3dc -Pipe 134 -Comment "NGen Worker Process"2⤵PID:2760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3c4 -NGENProcess 404 -Pipe 3f8 -Comment "NGen Worker Process"2⤵PID:3892
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3fc -NGENProcess 408 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:4056
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 418 -NGENProcess 3fc -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:4744
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 3fc -NGENProcess 394 -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:2712
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3a0 -NGENProcess 414 -Pipe 408 -Comment "NGen Worker Process"2⤵PID:1508
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 414 -NGENProcess 418 -Pipe 40c -Comment "NGen Worker Process"2⤵PID:2744
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 410 -NGENProcess 424 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:2776
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3c4 -NGENProcess 418 -Pipe 404 -Comment "NGen Worker Process"2⤵PID:4532
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 428 -NGENProcess 414 -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:4452
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 414 -NGENProcess 410 -Pipe 424 -Comment "NGen Worker Process"2⤵PID:2392
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 430 -NGENProcess 418 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:3500
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 418 -NGENProcess 428 -Pipe 42c -Comment "NGen Worker Process"2⤵PID:4496
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 438 -NGENProcess 410 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:2012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 434 -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:4828
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 438 -NGENProcess 428 -Pipe 430 -Comment "NGen Worker Process"2⤵PID:4628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 428 -NGENProcess 438 -Pipe 414 -Comment "NGen Worker Process"2⤵PID:4848
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 438 -NGENProcess 440 -Pipe 434 -Comment "NGen Worker Process"2⤵PID:5056
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 44c -NGENProcess 420 -Pipe 418 -Comment "NGen Worker Process"2⤵PID:3324
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 41c -NGENProcess 448 -Pipe 450 -Comment "NGen Worker Process"2⤵PID:3988
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 454 -NGENProcess 410 -Pipe 414 -Comment "NGen Worker Process"2⤵PID:3292
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 454 -NGENProcess 41c -Pipe 420 -Comment "NGen Worker Process"2⤵PID:3372
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 41c -NGENProcess 438 -Pipe 410 -Comment "NGen Worker Process"2⤵PID:3844
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 464 -NGENProcess 44c -Pipe 460 -Comment "NGen Worker Process"2⤵PID:4752
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 44c -NGENProcess 458 -Pipe 468 -Comment "NGen Worker Process"2⤵PID:3348
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 440 -NGENProcess 43c -Pipe 45c -Comment "NGen Worker Process"2⤵PID:3556
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 46c -NGENProcess 41c -Pipe 438 -Comment "NGen Worker Process"2⤵PID:3944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 41c -NGENProcess 44c -Pipe 458 -Comment "NGen Worker Process"2⤵PID:2128
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 478 -NGENProcess 428 -Pipe 448 -Comment "NGen Worker Process"2⤵PID:4436
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 480 -NGENProcess 474 -Pipe 47c -Comment "NGen Worker Process"2⤵PID:4172
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 41c -NGENProcess 488 -Pipe 478 -Comment "NGen Worker Process"2⤵PID:2000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 454 -NGENProcess 48c -Pipe 484 -Comment "NGen Worker Process"2⤵PID:4484
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 440 -NGENProcess 464 -Pipe 43c -Comment "NGen Worker Process"2⤵PID:4664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 480 -NGENProcess 474 -Pipe 46c -Comment "NGen Worker Process"2⤵PID:4856
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 428 -NGENProcess 41c -Pipe 48c -Comment "NGen Worker Process"2⤵PID:3100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 490 -NGENProcess 464 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:2464
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 494 -NGENProcess 474 -Pipe 470 -Comment "NGen Worker Process"2⤵PID:2608
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 498 -NGENProcess 41c -Pipe 488 -Comment "NGen Worker Process"2⤵PID:1656
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 49c -NGENProcess 464 -Pipe 440 -Comment "NGen Worker Process"2⤵PID:3168
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4a0 -NGENProcess 474 -Pipe 480 -Comment "NGen Worker Process"2⤵PID:4948
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 494 -NGENProcess 41c -Pipe 4a4 -Comment "NGen Worker Process"2⤵PID:5012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 4a8 -NGENProcess 44c -Pipe 428 -Comment "NGen Worker Process"2⤵PID:3988
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 474 -Pipe 464 -Comment "NGen Worker Process"2⤵PID:3300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 41c -Pipe 498 -Comment "NGen Worker Process"2⤵PID:868
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b4 -NGENProcess 44c -Pipe 49c -Comment "NGen Worker Process"2⤵PID:3560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4b8 -NGENProcess 474 -Pipe 4a0 -Comment "NGen Worker Process"2⤵PID:3496
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 4bc -NGENProcess 41c -Pipe 494 -Comment "NGen Worker Process"2⤵PID:3388
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4c0 -NGENProcess 44c -Pipe 4a8 -Comment "NGen Worker Process"2⤵PID:2224
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4c4 -NGENProcess 474 -Pipe 4ac -Comment "NGen Worker Process"2⤵PID:3476
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 474 -NGENProcess 4b8 -Pipe 4cc -Comment "NGen Worker Process"2⤵PID:4232
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 4b0 -NGENProcess 4c8 -Pipe 4b4 -Comment "NGen Worker Process"2⤵PID:4312
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4d0 -NGENProcess 4c0 -Pipe 490 -Comment "NGen Worker Process"2⤵PID:4296
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4d4 -NGENProcess 4b8 -Pipe 41c -Comment "NGen Worker Process"2⤵PID:4720
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4d8 -NGENProcess 4c8 -Pipe 4bc -Comment "NGen Worker Process"2⤵PID:2128
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 4dc -NGENProcess 4c0 -Pipe 4c4 -Comment "NGen Worker Process"2⤵PID:4436
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4e0 -NGENProcess 4b8 -Pipe 474 -Comment "NGen Worker Process"2⤵PID:4672
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4e4 -NGENProcess 4c8 -Pipe 4b0 -Comment "NGen Worker Process"2⤵PID:4724
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4e8 -NGENProcess 4c0 -Pipe 4d0 -Comment "NGen Worker Process"2⤵PID:4820
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4ec -NGENProcess 4b8 -Pipe 4d4 -Comment "NGen Worker Process"2⤵PID:2516
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4e4 -NGENProcess 4f4 -Pipe 4e8 -Comment "NGen Worker Process"2⤵PID:4060
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4d8 -NGENProcess 4b8 -Pipe 4dc -Comment "NGen Worker Process"2⤵PID:1700
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2348
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:1420
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1932
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:1996
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
PID:568
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2156
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:864
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2892
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2756
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:864
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3140
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3232
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3540
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3744 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3576
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 6002⤵
- Modifies data under HKEY_USERS
PID:3756
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD5b22f43d1e19bd0a3808fa57467767680
SHA1d9af3ecf2cccfe993e433314a9e2bce18b76d8e6
SHA2567462caffe68b7cd02ca1830a759040f71c860cf625769eecfb011920b127bebf
SHA512af2b198222dcf97c2391890de292e1984687a2eae94f66e4be04f8c66b62177496204c9da44063aa38051674b32028ae585b0ff3aa300be900744def5155fea9
-
Filesize
30.1MB
MD52835ce5f5dffe82fcddb596bed0aaf93
SHA1d8d298a288eeca8b079b9fb80ab8ddf40d97d566
SHA25616f4428190917d73d9ada9d42c290fa5e8bf990ed360d113b57a7ff395b81584
SHA512c59c84eb33932ef88a409c1572f4e3b8c1dc0ab0bf0279fc69a8b4360292fed6a413d51d70f09added3858d445df12654e9654effcfe08dfe0a8b6327db6de3e
-
Filesize
781KB
MD53fb4719cca7d5631d4bf0144d5bbca7c
SHA14f06267f8e06e5cfd72ee5778b9d15dd62b5c5d5
SHA256816c86f680290d70e15d50de32749bed56ac9140b85348b4f62163b09719c892
SHA512f27bc95b242cb4cd361a03d85dec916e094dfc9dfb804bc0bc0cbc26e5307d43e7da019c396d7cc4039cb491325a8f658cb84d25650cc8dc0cce8334c0554143
-
Filesize
4.8MB
MD5c8d018c3af9de32c7bc55c583123d620
SHA1e6d7b1df4b7b860882dcc679542ac698d0481d8f
SHA25639fa6e8321cc75cd0283c8902dcf8b594cfa605b861f3f273c4dd8beea46bc28
SHA5125adc93a9fe461dcde54a3b4da5ea30689efdbb57269c707071463d1fcc638fd6de1a79f8a26f84acc89f58db6aee939681621e875ec9f5e054b6a4bd9ec9dd55
-
Filesize
2.1MB
MD524c52c2c93db395e5a6ecfeaf956007e
SHA1a4401dcd4792a69a63800a47cc27c297f39cabb9
SHA256df4ae34f2da2e133be8d4f37b5402b828f04391619607092f97a694b7cfe1754
SHA5122cca81ae583d466d80d807efd760c6bff1c31e5a0213841ce0554b73edeb46d2903158c78c99bce412e0b5b2c4da34810111aa23f1179f773416241f0260e045
-
Filesize
488B
MD56d971ce11af4a6a93a4311841da1a178
SHA1cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
-
Filesize
2.0MB
MD5180ba362b8d2b3670106b8f4db65e465
SHA19e6bc9f1d81056155fe7d0c526f2154763334574
SHA256722c0929d61763a22b3a6ebeedcb64c7fa5f7c1150940ae59cf24c6cb0fa1025
SHA512fb054dea1d70b5d68bd9efedfa32579fe4704a91de4f63d3c66ff3e3aafe50406609d73dc5310abc6056b828bb19b05000260f218977624f559dd60ce2aad144
-
Filesize
1024KB
MD520f9c8ffb0344040af1e38e02bcb9017
SHA1bbf2674972d87cfcebd66ce8ce20893b32423b92
SHA2562dd331449436e4783303a73a24570c7c7f5b187052bce76a8f7f75684762ce54
SHA5129ece8df37969ea1fd082953fdac7dc9a13e6b2799a4639349ab3e6655c05eb96696b38cf68b1cbaf65576933a4197283350cd99d26f305264e25c02584fb2fc1
-
Filesize
1024KB
MD5c474c0a118d9cd20b78b45d4eb808005
SHA15177993796f18aea9833d7500f7a8650725ca362
SHA256b617c64898ebadd218cef1f09cb23625e139d5f473ce3357109e900193d66dbd
SHA512be548e83b1bf8d2c6a5727762fa6898ad068ee2e01a795d99e46eb87cfe4e562dbb5b539ce6708bdfebcd8f2e9661a1391a5f9b5f872f31dbac657da5f7f14c3
-
Filesize
40B
MD544691fdf709576c5467bd86b9d95cecb
SHA19c0e49c662f20cdd89217f1bb4b4ba701e659697
SHA256bbeef7deae86cbdb634c26982101647e319bb03dce941d124f0ab0edc8a76de9
SHA512e52fb7f7091ed7a21944c629081fa5069f47fc076911101e20fdcc183c35b7b460fbbfac56f1f91052b1d35a35e66ce2dafce70349ed34ca6f16ba1e1f1fabdf
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD564b0dc6290399c39dac02eb7e96dbe59
SHA11eb3101d936496b6f27eb6026323b0a38a85f040
SHA256d9c9aebc1e55a3cc9f7fa76c9a9cca00c2386458200274c1fe6bfcb6d8c3cae8
SHA51206f29c9c5ed9bc883b2959ac2caf013a7722562137c2d1ddc227928374c0455cedb7cf2bed219f77e2b504ee8618cc3c864d728b50c10b8e98f1027f4cb22354
-
Filesize
4KB
MD5134db33ee1cd875201e86b228c5b8db6
SHA1c4f56e7f38f3fe95f19e5099249376e2f649346c
SHA256d450023301c6adbd94e174eea17be75e5c9f41439d7d321e137d43464cfc07fb
SHA512d09b90bf26aa6ce08f417f4278a6943fae3c987afa294a4d7601ae81ad2c673c3424abaab2b3a751c5ba0f262005001132f5df77dfbb3d8bb87689194a548ca5
-
Filesize
4KB
MD5546f12ce93c0fb8514e0b5ced55cad0c
SHA1e52be4a13e66ca80e74e50e4d47a26c333f39058
SHA2562827f8b843aabe935b1e1a8d895c57ebb90a98496ae93234aadffacfd903ae82
SHA512a9eaff796c60733fefef3431c2f95e4f8868babdd8db4ca6b21638abb777bd5c3e647b87e499d0c520c20d4657d4cafae6c7ac708f032dc0885d056c1790327a
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
8KB
MD5e1972497a1a537a636211dcace2d396a
SHA1414f888f9d9d510740798c49f11fa25ca151b43d
SHA2565e512669a1559f642116c53f1cac3e07f74f642dcc7362201324664dc5b6a49d
SHA512669af2e72622495cd905750279135191793a1cda26b6acae0f04be0785123a935d40f0af7bdab2aee6da5940a48518c5248559fbd13cfe2b76f33716f0e8d3fa
-
Filesize
9KB
MD5c225aad66fc8e6ba0896a6b830733108
SHA165b627e3be560749d6f30d13a31b525008b7bb4a
SHA2563fd2b2033b0c239052ec200a8dba232cac094dc805d5339e56fbae2de9a5eff1
SHA512213c435798aa312b9ddd5f211faf6f2757de308dc7151cd6fe09b090277ae624818e10632afa39fc796227369556c6bef2f41cf721e7a10c52f08533b1b88743
-
Filesize
88KB
MD52cc86b681f2cd1d9f095584fd3153a61
SHA12a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA256d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
SHA51214ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GSOBCFOWTI1W71BLPELW.temp
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
872KB
MD52c82a44fc1eff6a13e450d686d249ff7
SHA10ea5907737f4ec1aa0fb7a4895e4c63492aa145c
SHA25609b2437c6c56a87b480525fefc9ea8b89e5b6fde50393d948fef695b773faf3c
SHA5125ac589d8e2d501845910908959b6f90fee121a4d0e2ef581626b000777516d8116a5b4a6a89e4378e549850fb4178ea8492654db7e3ef2670ac4caf7f800e8e3
-
Filesize
603KB
MD521e6c1f33a34313f5303ddbe80dded51
SHA18a109b15976f757550c3718e78bd6b10109e6901
SHA2561fb693adc5d3f2989e5dd0323f230d9dff79d948103b60ee6a732d8096812d94
SHA512c88cf33d28b96f0a0f7249cea9224d94b6eaee31a4a45932629f4f2d355831bd4f2440e5fbb8ab1cba484fca342447e838d4a1cb01234066440978fe7cf941a3
-
Filesize
678KB
MD5a074b8592cc976f4f29b327ace5ccf4f
SHA19b5e40b4eb4a7b1fae45855d35d02c92ddbe211f
SHA256842fbf7f2d804e7541695ce13b203ce935f8ee0d8ef9ae852acf4c46a04cacb8
SHA5120b337f1394f8785a191e6eb083b7869d473bcece0f2cae22c6831aba07a76dbb9d19c071978151317e0fafae9019f86d8fc556c60caae211380e9d8471d4717d
-
Filesize
8KB
MD52d5ffe97a584cc3250e589163ebaa4ea
SHA1c02b83d881b3b08a05bf9aef09a23ba161e1110a
SHA256252a45a1121dd82855397bc1878c00a8867f1630f6da6baa6e63e24e6c13e14b
SHA5127a8df5237235d2f05c90b2f7346ca9f064937fd910ffe62e9441dd97b0921b3619924a4efc285797f15f063b1146ff443dcfdce56cb85a665bf684608410b8ec
-
Filesize
625KB
MD5705301808d0a25b01722274a6504e5ce
SHA1a1f6f7c6d0095dc4542d7a61fbdeda4da2a0b5c6
SHA256dc924c3f3c58db6bb6a06a4f705490984430c51d46060aec571eaa9f1493177d
SHA51289078a2be5d71fdd6f1ff539823a23199192b723bfa9fe3974a0a43449889f9c2a7b3f977b6b5cd83bbd1f245dadb66c2473e32f4508f9e88870e8352e09a050
-
Filesize
1003KB
MD56634b7802a521d618709699bd57a1f66
SHA1f8aa458a6112a7b6236f3e8c1e8fc448b12bba70
SHA256f09ccf1eecca7deaf051758b3de6490b3b685f61aae172235bf02430238ac6c4
SHA512699ac289c599a4c18981c331b4ac1a38e37b4b0c52b58875f9b3a52181c76686dc2d36239ffd7d7ab95de1e74a05e27354595ff8564520c56c589d3c54be92f3
-
Filesize
656KB
MD53f28b51774f051293adb87a3b762af15
SHA1e09ddccdd06de7c45509c7b4ef77bfeb9839e4ac
SHA2567f4f273aa257b4325a8b504c1a838edd5a1fffac51079ce0e44cde8a3cc0c6ec
SHA5122e6a25d6612236671fedba961c791847f2e769ccc0a8230a4ea922c50ba005256bac2e318bb582e230120cc3b0210000f92d6207d121309d2582e75170499a1a
-
Filesize
12KB
MD5f642cdb9e6020738135b97419910e80a
SHA102cd174c6db5742d12d12240ab6c42f542e7fe10
SHA2568781c679c3cb7bcaa9cf1c640119b6c76371ba16062157f25c6c8d594899b137
SHA512503822f811932cfbeabe70420ce56df081f461bb426e6506d0b19cdc2503f1b03df1bbece12e6500749e97c16b43d0f21370d0a2a2d626d3431a916891041c89
-
Filesize
587KB
MD50223fd99a7cc58465ef07416b5afb3a4
SHA18c327294a362c9cd28a15aa0f75e1eb7387cf716
SHA256cc14a554635e2dd45d9b5005ffaf2d4713e34c826450e8d170fc330744895828
SHA512c5bc4c393f7f4ef7d88f391040bc6ab7ec9384ca60cbb84b5f9acfc2ea8b3650486ffff9561b6c241741e5211f67f98ec44931bcabbf0765e4f204eba5fdcc2a
-
Filesize
1.1MB
MD5af90b783b709efde19cfcdb942ae3b4a
SHA10d43bd0a707b876413c3c0b668ceba70af42238d
SHA256982c63be5dad04bdfbe83c6c50241daeab43b77f9bdcac505f37f208aa16c6ce
SHA5123fb851c7ea71e74bad05b3940e218d4e50cb131c7f513a17a19126d82610693861b62ecb5374ee87e05dc0fc2d43441703f69a03a5671b90db98546265d68e7e
-
Filesize
2.1MB
MD5ac6dd64b956503bf3cd11c6f620e2489
SHA187c308c709cbdf991a9dcd549df1b8614986cc7a
SHA2563d14b440d466ac88c32f21634daf6494c499624824abb5ae0edfabbce0465d18
SHA512a559162fa6db94e58b28572814adc3c4276d4cf233c4bfb0fe24a4997a130b2b016cf75183e2aeba32539cbd3511eacb92c1a9e7dc6faca6798fbc3c7b726d56
-
Filesize
644KB
MD5c76c7e0a67cd823338e371fa646756f8
SHA1ab3a8cad5fd0eaa4932606cc14f947c950f9637b
SHA2560a98241638618cb86720e1012a3b4968ed9b6b572dc0650e0da2bd1c011507bc
SHA5121acc2787292110b49448dac6258be1f359964cde507a9c65af677628f508cb0bc4631fb4b81f4614564fb7a44a2af1ba1a1866140dffa1739bc41ecd196f886b
-
Filesize
674KB
MD58a282eba3eee3b94b1a5c98a356eb0c3
SHA1cdc608c32b521685b32b6b29edf32f207284ee42
SHA256dbf16957b873fd9ddce4c6aad0bd05abf4d811bcd6360eb6654ea2a5c3f542e0
SHA51266cb5e51dffe333c8f2006959ae30b82cb26c53dd0bf4f047f796d5a8bc907d4daae85ac8863d2fc8f3f3fd98c40d65df735613b730abf124e86e407e37bfc7a
-
Filesize
691KB
MD5cd7ba117ec816441b4019a730711961f
SHA1584b6715b2db74b8f7520ea3f4c182ce612fade5
SHA256624f493dbfa4d4e5f010cfef8b6dd1d6155a7a4a2f111ab84e27cdcdaf6ea475
SHA51272ef949a146c67ad392fa9a1dc45d85689895a9054189425fc413b555cde628a6d088a6185777b80c9a461cc630da7a359aa21c5132f9a9378f5e2993f8df49f
-
Filesize
581KB
MD50c127f82dba9ae6ffb309ac0f160a204
SHA10baf8d32996c8b2c874908c468e50aa46c202728
SHA25626cb15e83a9314f751dc926177c3fc15f888a6ff0edf8baff4918b92d39b55f8
SHA512a6ff2fb18e68cf06c8ed28e87b868008d3340a933ed0b8d6bd651b6dc63fd2e606f912a974f1e8317033427062e0ace803558a9313f8188f9cb54ad251fd6757
-
Filesize
1.1MB
MD5baab64a6ea82d2823c20dd2b2964f535
SHA17d8b80b76bdf57fbb0a40d12f92f4ed4602d10a5
SHA25633f4238d9360ce62f0707c11de13a8b048982e12a40a52b0d4959580dd12dcc5
SHA51200694dad90b28865fb2df9466cc435991eb8d9f6fc2ed0449b7c58bb0e80d2dbd230a7770aa655c6d4d9ca162e0bd483bc4139f358e443f2c480492e4f6820f3
-
Filesize
765KB
MD55659074409bd7ad0abd9cc67966513d8
SHA1b867dafc6f3377452d4cc9773953c2dfca1d29de
SHA2565f3c4efa9f49bd87e2d12541bdb4870782e92cbc398bad9d53bb29f231e67dca
SHA512f4cae7f87f42547a7eaaffddb67ab0edd598588654ca945ce2f6d2f2953dc7c2571aa2c05552d3287141dabf3c7faab69dade4a9917d42e7a06149533a7577ea
-
Filesize
2.0MB
MD563446d1c9580533abe1b0f0761795393
SHA1a54aabdf93fb73d04babfa79ba5a93e80b2d731a
SHA256d93caa9d1524b980660f8d1830fd6155899649d3b1451553cc7fb8fa73e5817f
SHA512c6a7ea11f661ef261ed9ec1a8391fc4cd1b2efcb92bc75edd9bbc44ac3c4100cc6d4bae5b866644ea51ce0ac1fc3988319ef1bb1281f8f76162dc9b1e3cd13d4
-
Filesize
40B
MD5d07aa9b70250d7b4db7cc100b9a878ac
SHA19b23ed78b2171926adc8a3a74bdb9a205f55bd86
SHA25663987f41f387a12a3a3f8e65eac438a5ca58337e98b0ea643081f9460085df72
SHA512f58dbc0ac6982c6935193f9d6309fcc356d011663d2accdd92b5e4a981b8523a215f3681fb5681175f240fc3f34244153fe9de6cd0c1c00ccb3300043674696b
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
Filesize105KB
MD5d9c0055c0c93a681947027f5282d5dcd
SHA19bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA5125404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize1.1MB
MD57835e60e560a49049ae728698da3d301
SHA187b357b1b3c9a2ad2f3b89b10a42af021ab76afe
SHA256df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa
SHA512b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize238KB
MD50a4ed78b7995d94fa42379f84cd5f8e9
SHA190ba188fe0ebd38ad225e7ce3a24dd9b6b68056b
SHA2560a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86
SHA51286ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
Filesize248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.8MB
MD59958f23efa2a86f8195f11054f94189a
SHA178ec93b44569ea7ebce452765568da5c73511931
SHA2563235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6
SHA5123061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize1.0MB
MD5598a06ea8f1611a24f86bc0bef0f547e
SHA15a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0817dd144bd1703a16af65cf81ef80e6\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
Filesize759KB
MD537c49cf471f7ad881127f9e38bed1a10
SHA1473c3a7a28d138ccfff0d971a1ce9360ab990aba
SHA2569ef88d67461f4d91de1e16fab938d5561db9d04898d8776f9e716fdd52f91369
SHA512e88e5b3b41b5763ed7de4d3ef40ec77144252c30d8d67f5b387b905026bd856e9d70889ccf9f78b0c0a7b0298ca8afdbaed133675001dc60593c6fbc31e93c47
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\19c2b79f666960d7a242a04c5d76f114\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
Filesize227KB
MD54ec89a4e8fe1b5b9916ace8dbabc0418
SHA1dafec0baada7f2fa425978a5816fe852053fb1fc
SHA2566c4f0f9775fbaf81122cba659cdd5449974810c772d51e152fc20016211988e0
SHA512648704c9808193a045035858b68f7e98981da8c1c98f07e04afacb1b181beeb0bf7df9f42a563636093aff05f01f0c7faacdde0561e9e8776e914611f9f43b34
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\36c5a9d83dfb1b6b1c0202fb505c9daf\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
Filesize221KB
MD578c5a493778f578ef5517fe161162819
SHA1faf377bdc739623fb5f111d51af97e8c78f11525
SHA256aa332098d4073a4c4a654d16ec5fd0b6e2b1f284890057e164204d756095dd93
SHA5126a905ef75d2eb909cd30c3916110f6b41a849ff4ed9f4c19e4d5f85ccf05d9b9dd009b351003386778801909d2628ce4c6cd9b1a54e3a0cd1ab9c5496f35cf50
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4758b8121543dcdb3ad42e4d30efdc03\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize122KB
MD57c811829422cf9523ac9a45ef70dee9b
SHA1c7def6cb9905a03fff1489f3cfa86b8673aeb15b
SHA256fdf8d734d1d070171772d6ee5dbfa10fe9264e0efd16a4ad4dd626eb9b734059
SHA512e27bcfbbfc9fd6c4066a4e9b399d13f1c64d1c63ffa11c56a9e644fc47555e183868df6348ba3ff5efb79d3ac1c60d2de3efb83a33093ef588e3f493569a294c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Filesize91KB
MD5adc5887e89bc56694a193d92898d3518
SHA1267f14c45a86d50ad627c6cb00626049e9c1ee20
SHA256edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b
SHA512bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Filesize1.8MB
MD504a6857c04546270358d14398fde209e
SHA1596a3e11ac6c303c679edfd6c30aa71e8eaf8a23
SHA2568eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285
SHA5124e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\62b05f8c4a300d02f727eacc5a0eb7b2\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize221KB
MD5885d4e920c99840f80c928963086c2c8
SHA17bacb0b3e6e99333fb8bf77d27e7442236d72ae7
SHA2568c479bae4e8883823d2106951b02552c0519fdee1e0dc90bb9c804656a15773a
SHA512217af852c3f45119c5ae2f119eef0b9700998a765da26b132a4f8aa252b4e989769514f93b4a83afaab38850c444dbc6ccff83d5bc79567bbf249d7e763f3669
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
Filesize381KB
MD50811b25e0449e04f782127bc6f8ac5e3
SHA1dc1766e20ee338b12fa80e3ce0052ef97ddf9e20
SHA25620d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c
SHA512a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\74054b5793bfb8c8c0753b4d4aead8e3\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
Filesize947KB
MD5b1aa17d171be82960213057ca35815a9
SHA16c68a8a2c524ddbe04395dfa613378bb311aa314
SHA256c632156c276f9189d0f53addcc1043006d86188e3b74d9c4042ab2110b6cfd4e
SHA5126f042aec9c74da86d15322d4300d93e4a9e69ad3555b302d42d7629dfa060209898b4569a380e9da1a785ddb53a6e0cc0f7543606f17ee467277990971c2fc1a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Filesize483KB
MD5aae5a97685a809d0a0f661f9319f8a12
SHA1b5fdd4ec4cc057fccc868de4f4910be89e23e48a
SHA256c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233
SHA512d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ad7d01564f0056d2476f6ae5d257356b\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
Filesize436KB
MD5748bed51a810c033b91c660b5776ab95
SHA1ec2616fb01949fb9fe4b0eea707f7095b69aa9e4
SHA25645ee38adadeb1586532e8dd4baba14740ccb0801c2e21318c35268543e0ddef7
SHA512dc0cce4c633b8e43d8f6d565fcfc73d79bfea375a79ae5057af6d3cc1b62f929e34c95bcfe2f7d378ec7f421fafdd9ab73cff454df0934e2d2f45a52580e9df0
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\b22777deb45f6aeebf6bc7753dd76eea\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
Filesize220KB
MD55c35887a0b76108f6fb6daac51256ef5
SHA13be6ece2f60d205bcb955a5da0aa182d83cc1899
SHA2569f8de356dab305f2be5cf1f75934eb6b87072e1745ab5ee73ab4b319bb9a2b5a
SHA5120d1d2e5dd3ec776fab85e8f3b8cde32718bbbb52463c2702a17336326570a2fd624b0e32fd98182bba8c25fdd57ba861edebc1f00cfa66c04ec1c8a6f10fcee3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\c23fa100b8a915453a4db838ed3f7ddf\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize305KB
MD58f041d6fc4cff8d5229fd3181c1fbe30
SHA18e4da733720a2a6e50b54ecd1b1f62db07593fcb
SHA2568e6a58b7950e1d89ea4fe9d401d3e82133eee88f86486094cfc9a5611447e156
SHA512e7970f4fc1aaf57ac74f3da92ad5a8d5a3071f91169043392665ae541a691c18972f3ee6a6b393692fdb1db4c5c8a030cf806d50858628963bcac6032aec8891
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\daa561280ac1119d9c2694442212aaea\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
Filesize487KB
MD5aefa28d036740086ae52d157f245200a
SHA1d502f55fa76c3cdb69c8ab97321cd9b9a4b68e55
SHA25675127c1e3a30e544413d7eb24fd726bacf8c3a3951ddba1fc990ad00a7f1cc49
SHA5123943c099644525fc2b3a50f843cc1612a003d4f92a9187b2fcecaaf90b33071bced0db4608a91bb59c6bf5d1f6f4eb158881bf78cced0597b7bc3045d9b66ee3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fcf12062c04822672329fd65ce77a564\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize271KB
MD510a7cc219611bee96b2456234e6383a1
SHA1ed197c4e497899a95261d533ad651258d50d2795
SHA256128442ce4c0784c086fd6ce498e9f1d27dc4a8777cc52acbcdece77ad47e8fee
SHA512a5831ef47cfe7248ff888ffea20fbfa34dde2d8e43ce865d9a363ee9bf88f29b630cce70543f009e471cd19bdfcd6601367c843b37ea8da7f453baf67cd2bf1b
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
Filesize124KB
MD5929653b5b019b4555b25d55e6bf9987b
SHA1993844805819ee445ff8136ee38c1aee70de3180
SHA2562766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
Filesize2.1MB
MD510b5a285eafccdd35390bb49861657e7
SHA162c05a4380e68418463529298058f3d2de19660d
SHA2565f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA51219ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
Filesize88KB
MD51f394b5ca6924de6d9dbfb0e90ea50ef
SHA14e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA2569db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
-
Filesize
1.2MB
MD526789c500ffccab4f22e2b5a3653ad7f
SHA1003ee3d2b0399acfdaf07b63a0c652f8b0e0dcbb
SHA25635f834c80fad237a2abb0ac94ab3a5754220845a27d94e2b5060e5d89cb7f03d
SHA512dce7ee2f7d5c255317bc3d84e5c82ba00a10720096670a846c2a3aaf649bad2091d2186038ba3913cdc052f75fa7a3cec0b752c4f8c176d91c5e774a8260aca5
-
Filesize
691KB
MD54c49b01ea3c8f53b84f989359eb053f0
SHA16b3ce05780afb5ca8d2357f69ed7981e97d9612c
SHA25625f6650ee6e33f260d8bafebd652b62fe0ba87bb5ec08e5cbc2951ad39373259
SHA512046c876c7b65dd70e08678f029fae94f4d7177bc22371f16ed0ab47f80a5cc3c910a060e596863db4c58fab7ee6aac077b3600abce1d4080b0f5506c34259fd6
-
Filesize
648KB
MD54cdc0288f6110ab0749889f9e9685d0a
SHA127783e3d0a3bf8cde4789da8d8e4cdf7d78bcbdb
SHA25620f676a1385f04ce6c6269fb603cf30b78f7785d5ae97c40ea60acf226233ec2
SHA51278d6d0fd6c849a8f45b1a41be204a25fca4d395ef41f287a38e11be76f8618586f5be91cc118cb507f8363bd5406ac70288b0fd1f07f335323484511ac97d9ee
-
Filesize
577KB
MD53c45dcf0aaee98ce0c7bdf5da2627ce8
SHA19dee9955fd805230e6c7c8ae64c74e7752a011e3
SHA2567c6f0fcd4e3a49c8b3a09d596b34916b9dc47a3f5e47e57088d870c179d1dfe7
SHA5128cbe0dab63a07e3d28db1a6e09ffea8de42bde66f1112dcb44953e9fc0fa707c53700376db093a37ba658e6d810d269073cdae5d3edc89e40fa14131e218dd60
-
Filesize
705KB
MD5bf9e0841e0365f97c00938f05a4dd50a
SHA1720905005016ca140fcc70629a27b3987d594f76
SHA256ab5e0850f6b1914ec112b0f1a7511f30271b680421a65365f6fdef2e27c480fe
SHA512879ed08f80c8194db0fc0338de32c13dc0f946e5af28aa847bcffa0212741f2ec2f68ac8edc25efe0df3be63fdc4d988b7863a379f013ebb156719dfb9def556