Analysis
-
max time kernel
44s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe
Resource
win7-20240903-en
General
-
Target
2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe
-
Size
3.2MB
-
MD5
0c58bf93ab6ad2610dd38502a08c0577
-
SHA1
e0b59abb274562d3cd98bbdb1b594a93810a15a3
-
SHA256
a389861b84bd87b5c5086e7c08c6e9e95c22aca1ae27f54699e82bf0e088a2f5
-
SHA512
726a264cf2dcbfc3991677c67e20e7d7fc46290fd5751b965928644134b22f73936cd2c2e1b618bac9fc1d0b57e29eb5c19190e12e70ddbe8e0dc510eed9a259
-
SSDEEP
49152:M5k1YCdptya507NUUWn043oHS3fTIYwVq1/xT3DDbw0TUqyIgDUYmvFur31yAipZ:CNhSMYw8ypU7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 49 IoCs
pid Process 476 Process not Found 2548 aspnet_state.exe 648 mscorsvw.exe 1700 mscorsvw.exe 1868 mscorsvw.exe 2724 mscorsvw.exe 2804 ehRecvr.exe 2040 ehsched.exe 2136 elevation_service.exe 860 IEEtwCollector.exe 1536 GROOVE.EXE 2808 maintenanceservice.exe 1124 msdtc.exe 604 msiexec.exe 648 OSE.EXE 1980 perfhost.exe 3104 locator.exe 3228 snmptrap.exe 3324 vds.exe 3428 vssvc.exe 3512 wbengine.exe 3724 WmiApSrv.exe 3000 wmpnetwk.exe 3340 mscorsvw.exe 3740 SearchIndexer.exe 3796 mscorsvw.exe 3192 mscorsvw.exe 1300 mscorsvw.exe 3652 mscorsvw.exe 3744 mscorsvw.exe 3796 mscorsvw.exe 3652 mscorsvw.exe 1412 mscorsvw.exe 3204 mscorsvw.exe 3356 mscorsvw.exe 3600 mscorsvw.exe 4028 mscorsvw.exe 3920 mscorsvw.exe 3736 mscorsvw.exe 3440 mscorsvw.exe 3640 mscorsvw.exe 3756 mscorsvw.exe 3288 mscorsvw.exe 3908 mscorsvw.exe 3592 mscorsvw.exe 1384 mscorsvw.exe 3520 mscorsvw.exe 3384 mscorsvw.exe 3816 mscorsvw.exe -
Loads dropped DLL 13 IoCs
pid Process 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 604 msiexec.exe 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 760 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 19 IoCs
description ioc Process File opened for modification C:\Windows\system32\vssvc.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\837b70d4ab661a82.bin aspnet_state.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\system32\msiexec.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\alg.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\System32\alg.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{FC37790F-E395-416A-A1A1-53BC987E89B4}\chrome_installer.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe -
Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe -
System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GROOVE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-107 = "Lighthouse" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-102 = "Desert" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000701fe320ef31db01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\isoburn.exe,-350 = "Disc Image File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090f66420ef31db01 SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0dbc71fef31db01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-118 = "Sleep Away" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f015f51fef31db01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{04104BA3-9CEA-4CC7-8FB9-65ADF3949F52} wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings GROOVE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200017 = "GobiernoUSA.gov" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-108 = "Penguins" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010295523ef31db01 SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001077ef1cef31db01 SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2984 chrome.exe 2984 chrome.exe 568 ehRec.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2416 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe Token: SeTakeOwnershipPrivilege 2908 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 1868 mscorsvw.exe Token: SeShutdownPrivilege 2724 mscorsvw.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: 33 444 EhTray.exe Token: SeIncBasePriorityPrivilege 444 EhTray.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeRestorePrivilege 604 msiexec.exe Token: SeTakeOwnershipPrivilege 604 msiexec.exe Token: SeSecurityPrivilege 604 msiexec.exe Token: SeDebugPrivilege 568 ehRec.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2724 mscorsvw.exe Token: SeShutdownPrivilege 1868 mscorsvw.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeBackupPrivilege 3512 wbengine.exe Token: SeRestorePrivilege 3512 wbengine.exe Token: SeSecurityPrivilege 3512 wbengine.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2724 mscorsvw.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 1868 mscorsvw.exe Token: SeShutdownPrivilege 2724 mscorsvw.exe Token: SeShutdownPrivilege 1868 mscorsvw.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeBackupPrivilege 3428 vssvc.exe Token: SeRestorePrivilege 3428 vssvc.exe Token: SeAuditPrivilege 3428 vssvc.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: 33 444 EhTray.exe Token: SeIncBasePriorityPrivilege 444 EhTray.exe Token: SeShutdownPrivilege 2984 chrome.exe Token: SeShutdownPrivilege 2984 chrome.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2984 chrome.exe 2984 chrome.exe 2984 chrome.exe 444 EhTray.exe 444 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 444 EhTray.exe 444 EhTray.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe 2160 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2908 2416 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 31 PID 2416 wrote to memory of 2908 2416 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 31 PID 2416 wrote to memory of 2908 2416 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 31 PID 2416 wrote to memory of 2984 2416 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 32 PID 2416 wrote to memory of 2984 2416 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 32 PID 2416 wrote to memory of 2984 2416 2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe 32 PID 2984 wrote to memory of 2780 2984 chrome.exe 33 PID 2984 wrote to memory of 2780 2984 chrome.exe 33 PID 2984 wrote to memory of 2780 2984 chrome.exe 33 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 332 2984 chrome.exe 37 PID 2984 wrote to memory of 2268 2984 chrome.exe 38 PID 2984 wrote to memory of 2268 2984 chrome.exe 38 PID 2984 wrote to memory of 2268 2984 chrome.exe 38 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 PID 2984 wrote to memory of 1628 2984 chrome.exe 39 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-11-08_0c58bf93ab6ad2610dd38502a08c0577_cobalt-strike_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=92.0.4515.131 --initial-client-data=0x17c,0x180,0x184,0x178,0x188,0x140221ee0,0x140221ef0,0x140221f002⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6959758,0x7fef6959768,0x7fef69597783⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:23⤵PID:332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2112 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:13⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2120 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:13⤵PID:276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2860 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:23⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3120 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2860 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:23⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2208 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:13⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3480 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3588 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵PID:3656
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4d7688,0x13f4d7698,0x13f4d76a84⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵PID:3892
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4d7688,0x13f4d7698,0x13f4d76a85⤵PID:3936
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3816 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3688 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1360,i,11649521432085250076,8959742783080742199,131072 /prefetch:83⤵PID:3264
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2548
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:648
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1104
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1700
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3192
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1300
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 24c -NGENProcess 244 -Pipe 1dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 250 -NGENProcess 240 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 250 -NGENProcess 244 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 258 -NGENProcess 240 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 258 -NGENProcess 250 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 250 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 270 -NGENProcess 23c -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 25c -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 238 -NGENProcess 250 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4028
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 240 -NGENProcess 274 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 270 -NGENProcess 280 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 284 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3440
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 27c -NGENProcess 264 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 240 -NGENProcess 284 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3756
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 290 -NGENProcess 288 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3288
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 294 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 264 -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 298 -NGENProcess 290 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 288 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 290 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3816
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3340
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3796
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 1e0 -NGENProcess 204 -Pipe 23c -Comment "NGen Worker Process"2⤵PID:2832
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 234 -Pipe 248 -Comment "NGen Worker Process"2⤵PID:2040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 250 -NGENProcess 224 -Pipe 244 -Comment "NGen Worker Process"2⤵PID:568
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 204 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"2⤵PID:3908
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 254 -NGENProcess 264 -Pipe 224 -Comment "NGen Worker Process"2⤵PID:2960
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 264 -NGENProcess 234 -Pipe 228 -Comment "NGen Worker Process"2⤵PID:2272
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 264 -NGENProcess 25c -Pipe 254 -Comment "NGen Worker Process"2⤵PID:3204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 26c -NGENProcess 234 -Pipe 270 -Comment "NGen Worker Process"2⤵PID:3756
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 234 -NGENProcess 1b8 -Pipe 278 -Comment "NGen Worker Process"2⤵PID:3200
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 1b8 -NGENProcess 274 -Pipe 268 -Comment "NGen Worker Process"2⤵PID:3112
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 274 -NGENProcess 26c -Pipe 284 -Comment "NGen Worker Process"2⤵PID:2300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 238 -NGENProcess 288 -Pipe 1b8 -Comment "NGen Worker Process"2⤵PID:1872
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 288 -NGENProcess 25c -Pipe 28c -Comment "NGen Worker Process"2⤵PID:2516
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 280 -NGENProcess 290 -Pipe 238 -Comment "NGen Worker Process"2⤵PID:3352
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 290 -NGENProcess 26c -Pipe 294 -Comment "NGen Worker Process"2⤵PID:3676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 264 -NGENProcess 298 -Pipe 280 -Comment "NGen Worker Process"2⤵PID:2180
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 264 -NGENProcess 234 -Pipe 26c -Comment "NGen Worker Process"2⤵PID:3264
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 25c -NGENProcess 2a0 -Pipe 274 -Comment "NGen Worker Process"2⤵PID:2100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 25c -NGENProcess 24c -Pipe 234 -Comment "NGen Worker Process"2⤵PID:3820
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 29c -NGENProcess 2a8 -Pipe 288 -Comment "NGen Worker Process"2⤵PID:2868
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a4 -NGENProcess 24c -Pipe 2ac -Comment "NGen Worker Process"2⤵PID:2324
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 204 -NGENProcess 2b0 -Pipe 29c -Comment "NGen Worker Process"2⤵PID:3904
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 2b0 -NGENProcess 2a0 -Pipe 2b4 -Comment "NGen Worker Process"2⤵PID:316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 290 -NGENProcess 2b8 -Pipe 204 -Comment "NGen Worker Process"2⤵PID:3352
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 24c -NGENProcess 2a0 -Pipe 2bc -Comment "NGen Worker Process"2⤵PID:2072
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 298 -NGENProcess 2c0 -Pipe 290 -Comment "NGen Worker Process"2⤵PID:3860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2c0 -NGENProcess 264 -Pipe 2c4 -Comment "NGen Worker Process"2⤵PID:900
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 25c -NGENProcess 2c8 -Pipe 298 -Comment "NGen Worker Process"2⤵PID:1480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 2b0 -NGENProcess 2a4 -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:2536
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 264 -NGENProcess 2d0 -Pipe 25c -Comment "NGen Worker Process"2⤵PID:1848
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2d0 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:108
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 264 -Comment "NGen Worker Process"2⤵PID:3356
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2d8 -NGENProcess 2a4 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:3796
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 24c -NGENProcess 2e0 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:1584
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 24c -NGENProcess 27c -Pipe 2a4 -Comment "NGen Worker Process"2⤵PID:2504
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2b0 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:2736
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:2200
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 24c -NGENProcess 2f0 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:1932
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f8 -NGENProcess 2d8 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:2660
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:1656
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2f0 -NGENProcess 300 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:1708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 300 -NGENProcess 2b8 -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:3928
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 27c -NGENProcess 308 -Pipe 2f0 -Comment "NGen Worker Process"2⤵PID:3920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2c0 -NGENProcess 30c -Pipe 304 -Comment "NGen Worker Process"2⤵PID:4004
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2b8 -NGENProcess 310 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:3784
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 310 -NGENProcess 2fc -Pipe 314 -Comment "NGen Worker Process"2⤵PID:3096
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 308 -NGENProcess 318 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:2640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 308 -NGENProcess 2e0 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:3628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 30c -NGENProcess 320 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:2180
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 320 -NGENProcess 31c -Pipe 324 -Comment "NGen Worker Process"2⤵PID:3044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 318 -NGENProcess 328 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:3764
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 2e0 -NGENProcess 31c -Pipe 32c -Comment "NGen Worker Process"2⤵PID:3384
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 24c -NGENProcess 330 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:1584
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 330 -NGENProcess 2c0 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:2308
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 310 -NGENProcess 338 -Pipe 24c -Comment "NGen Worker Process"2⤵PID:3932
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 338 -NGENProcess 31c -Pipe 33c -Comment "NGen Worker Process"2⤵PID:3528
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 308 -NGENProcess 340 -Pipe 310 -Comment "NGen Worker Process"2⤵PID:3208
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 320 -NGENProcess 344 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:1840
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 348 -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:1352
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 31c -NGENProcess 344 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:2008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2d8 -NGENProcess 350 -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:3336
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 2d8 -NGENProcess 27c -Pipe 344 -Comment "NGen Worker Process"2⤵PID:3756
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 340 -NGENProcess 358 -Pipe 338 -Comment "NGen Worker Process"2⤵PID:2964
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 340 -NGENProcess 308 -Pipe 27c -Comment "NGen Worker Process"2⤵PID:2532
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 348 -NGENProcess 358 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:2828
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 360 -NGENProcess 350 -Pipe 330 -Comment "NGen Worker Process"2⤵PID:3896
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 340 -NGENProcess 368 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:2512
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 308 -NGENProcess 36c -Pipe 364 -Comment "NGen Worker Process"2⤵PID:3528
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 35c -NGENProcess 370 -Pipe 350 -Comment "NGen Worker Process"2⤵PID:3208
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 320 -NGENProcess 374 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:3648
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 36c -NGENProcess 378 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:1352
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 370 -NGENProcess 37c -Pipe 358 -Comment "NGen Worker Process"2⤵PID:2832
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 370 -NGENProcess 360 -Pipe 378 -Comment "NGen Worker Process"2⤵PID:2868
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 354 -NGENProcess 37c -Pipe 35c -Comment "NGen Worker Process"2⤵PID:2612
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 340 -NGENProcess 388 -Pipe 370 -Comment "NGen Worker Process"2⤵PID:3852
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 368 -NGENProcess 37c -Pipe 38c -Comment "NGen Worker Process"2⤵PID:768
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 390 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:3048
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 374 -NGENProcess 37c -Pipe 394 -Comment "NGen Worker Process"2⤵PID:3676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 398 -NGENProcess 36c -Pipe 360 -Comment "NGen Worker Process"2⤵PID:3520
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 36c -NGENProcess 320 -Pipe 380 -Comment "NGen Worker Process"2⤵PID:3900
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 384 -NGENProcess 354 -Pipe 398 -Comment "NGen Worker Process"2⤵PID:3540
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 37c -NGENProcess 320 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:3352
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 390 -NGENProcess 3a8 -Pipe 384 -Comment "NGen Worker Process"2⤵PID:2932
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 3a0 -NGENProcess 320 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:2316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 3a4 -NGENProcess 3b0 -Pipe 390 -Comment "NGen Worker Process"2⤵PID:2708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 374 -NGENProcess 320 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:3412
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 368 -NGENProcess 3b8 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:2620
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 37c -NGENProcess 320 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:2572
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3b4 -NGENProcess 3c0 -Pipe 368 -Comment "NGen Worker Process"2⤵PID:3580
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3a8 -NGENProcess 320 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:2736
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3bc -NGENProcess 3c8 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:2936
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3bc -NGENProcess 3c4 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:1048
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 374 -NGENProcess 3d0 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:1692
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3cc -NGENProcess 3c4 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:2468
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3a0 -NGENProcess 3d8 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:2832
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3dc -NGENProcess 3c4 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3e0 -NGENProcess 3c8 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:4092
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3dc -NGENProcess 3c0 -Pipe 37c -Comment "NGen Worker Process"2⤵PID:3844
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3e8 -NGENProcess 3dc -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3c4 -NGENProcess 3d0 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:3612
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3e8 -NGENProcess 3d8 -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:2604
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3c0 -NGENProcess 3ec -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:3640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3c4 -NGENProcess 3f8 -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:2496
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3ec -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:4016
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3f4 -NGENProcess 404 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:4084
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3c0 -NGENProcess 408 -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:2404
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3ec -NGENProcess 40c -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:3184
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3d8 -NGENProcess 408 -Pipe 3f8 -Comment "NGen Worker Process"2⤵PID:3680
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 410 -NGENProcess 3c0 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:3816
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 414 -NGENProcess 3ec -Pipe 410 -Comment "NGen Worker Process"2⤵PID:4040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 40c -NGENProcess 41c -Pipe 3f0 -Comment "NGen Worker Process"2⤵PID:3664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 418 -NGENProcess 3ec -Pipe 420 -Comment "NGen Worker Process"2⤵PID:3504
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3d0 -NGENProcess 424 -Pipe 40c -Comment "NGen Worker Process"2⤵PID:3288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 408 -NGENProcess 3ec -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:1560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 408 -NGENProcess 3d0 -Pipe 418 -Comment "NGen Worker Process"2⤵PID:2856
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 414 -NGENProcess 3ec -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:2408
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 430 -NGENProcess 3f4 -Pipe 41c -Comment "NGen Worker Process"2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 434 -NGENProcess 3d0 -Pipe 42c -Comment "NGen Worker Process"2⤵PID:3920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 434 -NGENProcess 430 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:1008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 430 -NGENProcess 43c -Pipe 440 -Comment "NGen Worker Process"2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 430 -NGENProcess 434 -Pipe 404 -Comment "NGen Worker Process"2⤵PID:2008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 424 -NGENProcess 43c -Pipe 3f4 -Comment "NGen Worker Process"2⤵PID:1012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 428 -NGENProcess 44c -Pipe 430 -Comment "NGen Worker Process"2⤵PID:1404
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 414 -NGENProcess 43c -Pipe 444 -Comment "NGen Worker Process"2⤵PID:3116
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 43c -NGENProcess 408 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:3968
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 408 -NGENProcess 448 -Pipe 450 -Comment "NGen Worker Process"2⤵PID:3652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 45c -NGENProcess 428 -Pipe 458 -Comment "NGen Worker Process"2⤵PID:3932
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 44c -NGENProcess 428 -Pipe 43c -Comment "NGen Worker Process"2⤵PID:2760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 3d0 -NGENProcess 434 -Pipe 464 -Comment "NGen Worker Process"2⤵PID:2828
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 448 -NGENProcess 428 -Pipe 460 -Comment "NGen Worker Process"2⤵PID:1568
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 46c -NGENProcess 44c -Pipe 468 -Comment "NGen Worker Process"2⤵PID:1932
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 438 -NGENProcess 45c -Pipe 470 -Comment "NGen Worker Process"2⤵PID:1700
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 46c -Pipe 424 -Comment "NGen Worker Process"2⤵PID:3628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 3d0 -NGENProcess 478 -Pipe 434 -Comment "NGen Worker Process"2⤵PID:3612
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 428 -NGENProcess 46c -Pipe 408 -Comment "NGen Worker Process"2⤵PID:3860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 46c -NGENProcess 414 -Pipe 438 -Comment "NGen Worker Process"2⤵PID:3288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 480 -NGENProcess 478 -Pipe 474 -Comment "NGen Worker Process"2⤵PID:3736
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 484 -NGENProcess 47c -Pipe 45c -Comment "NGen Worker Process"2⤵PID:2308
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 488 -NGENProcess 414 -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:3852
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 414 -NGENProcess 480 -Pipe 478 -Comment "NGen Worker Process"2⤵PID:2060
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 44c -NGENProcess 494 -Pipe 488 -Comment "NGen Worker Process"2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 490 -NGENProcess 480 -Pipe 484 -Comment "NGen Worker Process"2⤵PID:3732
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 490 -NGENProcess 44c -Pipe 428 -Comment "NGen Worker Process"2⤵PID:1692
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 448 -NGENProcess 480 -Pipe 48c -Comment "NGen Worker Process"2⤵PID:2072
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 480 -NGENProcess 46c -Pipe 498 -Comment "NGen Worker Process"2⤵PID:3244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 46c -NGENProcess 480 -Pipe 4a4 -Comment "NGen Worker Process"2⤵PID:3556
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 480 -NGENProcess 44c -Pipe 4a0 -Comment "NGen Worker Process"2⤵PID:3652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 4ac -NGENProcess 49c -Pipe 490 -Comment "NGen Worker Process"2⤵PID:2480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 4a8 -Pipe 414 -Comment "NGen Worker Process"2⤵PID:584
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b4 -NGENProcess 44c -Pipe 448 -Comment "NGen Worker Process"2⤵PID:3240
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 4b4 -NGENProcess 4b0 -Pipe 49c -Comment "NGen Worker Process"2⤵PID:1452
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4b0 -NGENProcess 480 -Pipe 44c -Comment "NGen Worker Process"2⤵PID:1728
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4c0 -NGENProcess 4ac -Pipe 494 -Comment "NGen Worker Process"2⤵PID:328
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 46c -NGENProcess 47c -Pipe 4c8 -Comment "NGen Worker Process"2⤵PID:3292
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 46c -NGENProcess 4c0 -Pipe 4c4 -Comment "NGen Worker Process"2⤵PID:768
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 4b8 -NGENProcess 47c -Pipe 4a8 -Comment "NGen Worker Process"2⤵PID:2504
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 46c -NGENProcess 4d4 -Pipe 4bc -Comment "NGen Worker Process"2⤵PID:2436
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 4d4 -NGENProcess 4b0 -Pipe 480 -Comment "NGen Worker Process"2⤵PID:2768
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4d4 -NGENProcess 46c -Pipe 4cc -Comment "NGen Worker Process"2⤵PID:1412
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4ac -NGENProcess 4b0 -Pipe 4d8 -Comment "NGen Worker Process"2⤵PID:2628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4dc -NGENProcess 4e0 -Pipe 4d4 -Comment "NGen Worker Process"2⤵PID:2272
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 190 -NGENProcess 4b0 -Pipe 4b8 -Comment "NGen Worker Process"2⤵PID:536
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4d0 -NGENProcess 4e8 -Pipe 4dc -Comment "NGen Worker Process"2⤵PID:3776
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 4d0 -NGENProcess 4e8 -Pipe 4ac -Comment "NGen Worker Process"2⤵PID:796
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 4b0 -NGENProcess 4f0 -Pipe 190 -Comment "NGen Worker Process"2⤵PID:2556
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 46c -NGENProcess 4e8 -Pipe 4c0 -Comment "NGen Worker Process"2⤵PID:3468
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 4e8 -NGENProcess 4b4 -Pipe 4f8 -Comment "NGen Worker Process"2⤵PID:3452
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4e0 -NGENProcess 4f4 -Pipe 47c -Comment "NGen Worker Process"2⤵PID:3908
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4fc -NGENProcess 4b0 -Pipe 4e4 -Comment "NGen Worker Process"2⤵PID:3904
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 4b0 -NGENProcess 46c -Pipe 504 -Comment "NGen Worker Process"2⤵PID:1656
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 4b0 -NGENProcess 4fc -Pipe 500 -Comment "NGen Worker Process"2⤵PID:1440
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 4b0 -NGENProcess 4f8 -Pipe 46c -Comment "NGen Worker Process"2⤵PID:1148
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4b0 -NGENProcess 4ec -Pipe 4fc -Comment "NGen Worker Process"2⤵PID:2628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4ec -NGENProcess 510 -Pipe 514 -Comment "NGen Worker Process"2⤵PID:3664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 50c -NGENProcess 518 -Pipe 4b0 -Comment "NGen Worker Process"2⤵PID:2792
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 518 -NGENProcess 4f8 -Pipe 51c -Comment "NGen Worker Process"2⤵PID:2336
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 518 -NGENProcess 50c -Pipe 4e8 -Comment "NGen Worker Process"2⤵PID:3292
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 508 -NGENProcess 4f8 -Pipe 4f0 -Comment "NGen Worker Process"2⤵PID:3252
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 4b4 -NGENProcess 528 -Pipe 518 -Comment "NGen Worker Process"2⤵PID:2760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4ec -NGENProcess 4f8 -Pipe 520 -Comment "NGen Worker Process"2⤵PID:1376
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 524 -NGENProcess 530 -Pipe 4b4 -Comment "NGen Worker Process"2⤵PID:2436
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 4f4 -NGENProcess 4f8 -Pipe 534 -Comment "NGen Worker Process"2⤵PID:940
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 52c -NGENProcess 538 -Pipe 524 -Comment "NGen Worker Process"2⤵PID:2256
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 538 -NGENProcess 508 -Pipe 53c -Comment "NGen Worker Process"2⤵PID:1464
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 528 -NGENProcess 50c -Pipe 4ec -Comment "NGen Worker Process"2⤵PID:3712
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 528 -NGENProcess 538 -Pipe 510 -Comment "NGen Worker Process"2⤵PID:3648
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2804
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:2040
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2136
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:860
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:444
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1536
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2808
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1124
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:604
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:648
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3104
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3228
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3324
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3724
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3000
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3740 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2160
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 5922⤵
- Modifies data under HKEY_USERS
PID:3924
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD5d14495c15b36837fdc4b601424896444
SHA1119514070b801f899d719ab780e2978ce0001a2d
SHA25649fa6cec047cc5a180a8eacf466c79184f30f6dd81e29427f01729fbee6b6dc9
SHA512fdc52f2d7663b82c2d34473260d9a4b41b8b4f181867b5713de748beb9db7a48cf8e037f467b7e8d8815523738d517209df397b5ab5897c7f2f0a90a9eea77e1
-
Filesize
30.1MB
MD5119782e8e73497100b55059c514ec44c
SHA1cbd7de801203e30e8a1d287dd0b1ddf3d83a1f44
SHA2568b44822b64b94d70e635352a5d3ff56ef9dc1bf907dcf2c05a333ad3380ea329
SHA512de09d0d5bd72e87446c8a9af103188266ac7d59179691f29ae2796a6c88ea7a5f7a42260e01e5a7144017cc9c2acd9a4d7c86ab3dba8dca945b7c4dd271ee561
-
Filesize
781KB
MD51c2a1a743bbb7874e9e5b70943abd726
SHA11d2ac58e33c7399b79d32f7ce4b335741f2b3564
SHA2560de8a4e7d20451c0b05a671aa029ecd31676556e1b36ebf654cd8f3e62726430
SHA512aa683d8402e0742eabbcc176fe22de1cbcb93a3b8c80199f8d20036b1b2ffff02e2ddcd2695ae80dae54ae97f859e0886fbd9d5fa25e78d09adad7323a744e51
-
Filesize
2.1MB
MD50cb26bfca96e8c19d50feeb6b3378e1a
SHA15298fb161a0237354e1e5f23de5b32514807b1dc
SHA256b305e6b7eddbf1a7675e0646720839374e1a4c0714a7a92bbd4f88bc4b9e0402
SHA512b523a1c7ab975efbda2d197ba77e072a6fc4a2e2cdaf22717a03ca0529b15ff2ec2e2b1d42451abc4fb7215e88fa695af822ecf87219b13a1ad468d092280ae5
-
Filesize
488B
MD56d971ce11af4a6a93a4311841da1a178
SHA1cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
-
Filesize
1024KB
MD5a966de0604a7629db060cb5c0f8810c4
SHA110c6832e2b1f3d1c4b04e61d76daaf79dd2422ce
SHA2561a39ff3da1df5c90c9b2f9a96318f4db749eff0bfb53d49612e49da4f2678059
SHA512c7d6ef34acf66b6c54f8b1db25e269cd780f4d40200203efde4488db62f40cf860f4f4dfb7c9a1b8015ee107768bd8ef35754b006757119e3281db7b8591b316
-
Filesize
40B
MD51d6994c9e7456e30a9c2dcecdc184047
SHA1ad85ecf6f00da14dbde2b4b22e52809a02ad11cb
SHA25632d641a0b1a4d012ac26b4511e84b1ce3a0c129fccd4e85a78a31d46b14f1a8d
SHA51245820fc375361f0518efc53e283a5421a58ace75b2d4d94c9a190ac75a3b3717b9b797e8d27cec3014fcc9e9ea27f2ffc586777d8d658e0e24d379fe7604c607
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD59c179ff8a60ac06211598b5ad0b934a1
SHA1a3adef02d95e17fd785fb27ea571282521f44ca8
SHA256df7061e0ae7f287e59f7f3fc476111acdc73bca65053616bd50c8b478b4c4ed2
SHA512b1df60118717cb6e88fb517ff6a779475ef81c05313aea7a177815d59bf0dcc6c24fe84ddb4ea15dc4055418a21a2b5ea9b996185a78916f105eab3d9ce804a4
-
Filesize
4KB
MD5f5e847b54c15f2c7b9e3fe4df932ef7e
SHA1c222f7c905d60513edb1a1cfe086851b6ef1a9dd
SHA256f50678e4acbafe43369e98b5490e518f97988faad3d324d37f7a2b41c0953e63
SHA512a2f95aa2e595e1c7555dcbd2306d7c9aa662b6fd6d2ffbc5da1f421cfaf036c9beebf22c1028faceb57fc86237d00a831080dc2033040a32759a1f93b464cc09
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
5KB
MD56ec90359515336ee7177988e94d3e815
SHA109df601c99f77d4fbfd8e86929dd21baad7c9e82
SHA256afbfde95abdba0402e082dc6b854fd73a850772b04cae4087eccbcadb02b6209
SHA512e11850b115292b101f5e5834612332daad193b51c839e47154903b5917fecf27ac7fe396a332b6c6a505b3d83fd8ba517882a7a791171e26e7430cca555d40ef
-
Filesize
6KB
MD59be720c166e1042fa974023717c0e49c
SHA1320dd1048e8cc7f29c528c9439205b1c5792ccfe
SHA256674cfc8223a6e75af76d2b810f9b34367ecba764ed7e1e2361c868f81695646d
SHA5125709d363df63e01db851595c89e7caac8cb400895d05853ed91f0d3d398a10324f8781ace8c3520e3dd7e6ae3b5b9bee0c6201f6a35b80799b050779f9f1313b
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2984_1953884561\e6f3e4a8-0446-43fb-9301-2cc415c00272.tmp
Filesize88KB
MD52cc86b681f2cd1d9f095584fd3153a61
SHA12a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA256d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
SHA51214ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
-
Filesize
12KB
MD5b1448b65006ed8031ea0d0b9233a1091
SHA18913bc2683f3fb657f90dbc6da919eba65306664
SHA256e33c1fbe4b0b6e4421aa00785fb21da005b90c4029cdf84cbc3c2adf2ad9c303
SHA51214249359f80d3296a1f1eaea748fa046ebd07e8a587c28c9cd89550704cb066f20020e87a798cfda597d50b35fe3db6b11c15ce29c15220bf3400789e027e037
-
Filesize
872KB
MD56cd5f1133b9ef4e38ab3ba3df38fd7ee
SHA1f4a55ddd6763c586c150ace15239ba6015fc0c45
SHA25670715734540b3bb0fef381cdd1aeae884087400854149a860435c11bb39d5ab8
SHA512ca105362d7755b8497e6cf1270ea08c43231b37d8f38ba68762862027b5887d98dfa4a9bcd1d88b3c5176a35d4141fffc8a4c91c5b1b2a5caee24e50978ceb76
-
Filesize
603KB
MD515348546d599f47bc4a847d56b723b97
SHA10f25e60e1ea6e88e75314ea827ab9b5882f4d263
SHA256fdf5dfde5932595218a45bb54ca53823be7b6779f3c6ac865ce01d0159cf9e51
SHA512dba0ae2748b9de6b1c49c08894e5d85fd0dce77ef7c3b683ee3e9a25cbfa715a5b3b592d03f8c21ab82d9e56dfd5c484184815eb7d2b7829f09367ec20e4a680
-
Filesize
678KB
MD52cb01e2093a5d1fa32ba477874efff85
SHA1573f15522ab3c544692a5dde3686be125830b954
SHA256c56affcf2be7940fe195c228afacb4dd469f83b71d4314082eaa91dd76865d3b
SHA5120cd5abd12b0c0320a1212d934680baa69fabc2e9094bcb13a924b2d8200ba85dcaf1ddaa36a94ea7420150a1d4ba5e297741561ae4acf5fc57751c5e2e1e61a5
-
Filesize
8KB
MD5ac9efc26f99cc45c4c72eb7347fb483e
SHA186d6dcf4ccd29ea0793ca17ac88d9c7450cb626b
SHA256716f7dc184da9c04a6952d161b66ff30c19038d3e50706ea29c59c9d02d03e11
SHA512616cf3191c63d0ac936b4a1e531eb8f49f5b80e30557b41c80b684ffb1334438ea55f4c3e60182b58faa7d9a58c51fc3ee16f42a4d0bae8f4649df6bdb31b8d8
-
Filesize
625KB
MD545e87bd10d3763dfd53985bedad2239d
SHA1a5df5a6451cd7e541803109defa1c7505466b2af
SHA2569753ce9445e191535ad8dfd2af7f9c986835ad41904444b9a02016f5579f6549
SHA51225ae8672611e431dc7d569012b5f584f9ea1ab06c49a0d0b67ab3e4e2da5b049c0ebbc75d59fb136d5af9c8dc16c134211c6ad192ea3b3036940f71c17f15e6b
-
Filesize
1003KB
MD5bfe1b414f90f5aecba8c862e226f3715
SHA161c94aefcbd58e37a5f7c686f55415a7b2ac3875
SHA256fe8b90fcf7f2a3c56474c090b08a4ce7fa0e52887041fa1b059fdcba88ab887c
SHA5126f5b24c895609c07ead6b3dd1dd8db6165b795b46644f75ccb27d95c3548c8dcfbd53a1c81038078ca9bb35061377b871a04c897c210ea3d8c74a024d9b1357a
-
Filesize
656KB
MD5506596163dbe2254262d3edf2f9fa4a9
SHA16e170857d476999989f81ca04555293b5e994114
SHA25653efc352cb222eef9d2768fde3d9fbcf220e253b6cd8e27f1999649f2b44e94a
SHA5129a3ffc0ec9dedfc279e021392906b0638f11fe5cade1a3d032fa8bb10e56b76c27cd716e8fc1a2d88eac93b995e3fedff8ed528795b5a1be4467e6c11251edfb
-
Filesize
587KB
MD5efba092aad639629221694601d541f53
SHA196754ede17e76d8dc674b38a4ea0888ad1f1f225
SHA256ab6d785bed159de001fa3fc7615856870cc9e866401e4092933b5cd0b19636da
SHA5124be38180f8201e8aeedcf424c178bb85878f23a11d9b9e7b61d6433a3827958b309463b48dff0e011a04bc7413b6e24c2defbc2aa076b616608404afe9a83839
-
Filesize
1.1MB
MD5a8006aef5f40b618ff3cf11e7b848441
SHA1229badf3e70fb7ecffcbbf90ea88ed623dadac50
SHA25663b9709ab34c96d73f235ee0f47967d2d3747ace97137c73e3f3b8607e480adf
SHA512fdc7b789664551ea930dd99ff2a387c9f0b7df67dc68cff09dd3086753968a820afdb727288a380b5d80bc395da156ad08c10d900f999321a941ea208d7460ee
-
Filesize
2.1MB
MD56b66bc7e8a97383b91344ca62fcdd5fd
SHA18e1e34e937ccf96233cd2b9e0f9bd75d5fa69497
SHA256ef535626677388d29ff713ca0d10b5a6a903042639c3015c2a7d304cd07bdb6f
SHA512d84f7f9de5e66b4c9e3277ff60a83c8d1b8f0d4ce1391388a4de987b13f6558631355632d7bef5589abc537fcf104d0de059003244242cedfaa52cd59a2ff5e6
-
Filesize
644KB
MD5645c6f51efb157860d9ddcec4e4aca94
SHA137ba66cc1d80a0d09139d7991a9e35ef3482a9f2
SHA256e679116e95f672dde4c4885fdd17b8bd3512cd7547187fb4e09ea1d9ce302d72
SHA512ba983b987861b6dd39a8a389c94d33ac5a9673290574cf92168f545d117f30dab7a110be0fb9410702efb3c0c3b906504dee80cf4c8b974ba9106d96984451b8
-
Filesize
674KB
MD573c9b049aeabd74b114cb6e8ede34de8
SHA1dad815dabfb7da32926d0ace216056b34a30a26f
SHA2566310a66675d3892921e4708716eecb3aa3e2eddb9a559e586c7e994cf8f9fab0
SHA5127fb43a3f331e3fcdbddc0161d02df49207b5c091d6352d0ba7c7a799cfe98e860fdf9d0144c6c255bdf6742c6e44d2abb48ab1663569f3e04d43314fe58474aa
-
Filesize
1.1MB
MD5c402e02e0dd723a2f809850ab9cbb8d7
SHA13c8d13afffd52713f00e1ad24413a5e7b296912e
SHA256f35b3cebd84adcedd74e41b110cf42234d0e326c40f8677782ecdd4507b1b3de
SHA51282a171851795870b56dc2b613676336c75288e0a904b675b787087e6d525e72375739057d464df26c32671a79b5dda40332965d27b917afdb7c09b6fb7e4987f
-
Filesize
40B
MD5127dc0fc4a61078e78deb8151b27fb30
SHA11a35786ca105df7ec8845dd7bc8fa327d52e5f54
SHA256fcf1702466bb668b27caaefb829605f2b29da3daa59951e9c7b219e239792a4b
SHA5129a1b093818c5dce296b96a6745fa12f555b3a3b2e80999a5eafd1dff5cdb687417d2f04e1026b36a9028c458b319eccc41a805cb8355914aa9cef88ca0bee7d5
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
Filesize105KB
MD5d9c0055c0c93a681947027f5282d5dcd
SHA19bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA5125404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize1.1MB
MD57835e60e560a49049ae728698da3d301
SHA187b357b1b3c9a2ad2f3b89b10a42af021ab76afe
SHA256df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa
SHA512b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize238KB
MD50a4ed78b7995d94fa42379f84cd5f8e9
SHA190ba188fe0ebd38ad225e7ce3a24dd9b6b68056b
SHA2560a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86
SHA51286ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
Filesize248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.8MB
MD59958f23efa2a86f8195f11054f94189a
SHA178ec93b44569ea7ebce452765568da5c73511931
SHA2563235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6
SHA5123061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize1.0MB
MD5598a06ea8f1611a24f86bc0bef0f547e
SHA15a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0817dd144bd1703a16af65cf81ef80e6\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
Filesize759KB
MD537c49cf471f7ad881127f9e38bed1a10
SHA1473c3a7a28d138ccfff0d971a1ce9360ab990aba
SHA2569ef88d67461f4d91de1e16fab938d5561db9d04898d8776f9e716fdd52f91369
SHA512e88e5b3b41b5763ed7de4d3ef40ec77144252c30d8d67f5b387b905026bd856e9d70889ccf9f78b0c0a7b0298ca8afdbaed133675001dc60593c6fbc31e93c47
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\19c2b79f666960d7a242a04c5d76f114\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
Filesize227KB
MD54ec89a4e8fe1b5b9916ace8dbabc0418
SHA1dafec0baada7f2fa425978a5816fe852053fb1fc
SHA2566c4f0f9775fbaf81122cba659cdd5449974810c772d51e152fc20016211988e0
SHA512648704c9808193a045035858b68f7e98981da8c1c98f07e04afacb1b181beeb0bf7df9f42a563636093aff05f01f0c7faacdde0561e9e8776e914611f9f43b34
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\36c5a9d83dfb1b6b1c0202fb505c9daf\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
Filesize221KB
MD578c5a493778f578ef5517fe161162819
SHA1faf377bdc739623fb5f111d51af97e8c78f11525
SHA256aa332098d4073a4c4a654d16ec5fd0b6e2b1f284890057e164204d756095dd93
SHA5126a905ef75d2eb909cd30c3916110f6b41a849ff4ed9f4c19e4d5f85ccf05d9b9dd009b351003386778801909d2628ce4c6cd9b1a54e3a0cd1ab9c5496f35cf50
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Filesize91KB
MD5adc5887e89bc56694a193d92898d3518
SHA1267f14c45a86d50ad627c6cb00626049e9c1ee20
SHA256edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b
SHA512bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\50fafaa1198ee964e40aef17f5489f80\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize271KB
MD56a986b95d5f752061712801604f1b587
SHA1fa39207e4bccadbe6a72a47a2be6a53f92ca7d25
SHA2567865a1dc148b06f3d4b00b6c4071ba8b633231939366b2fd1fa31f56bf755805
SHA512e98816a5a233139236102eb3e5450eb456198400bb2cfdb4d0e82fde8fe856f92d170d1cc55be225b66a875f63cfad1c201e44c217fbd5d1f40caad55b4cdb19
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Filesize1.8MB
MD504a6857c04546270358d14398fde209e
SHA1596a3e11ac6c303c679edfd6c30aa71e8eaf8a23
SHA2568eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285
SHA5124e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6319713c334444d529b4218e182dc287\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize122KB
MD5388a633f84f95535f39d920fb72c086b
SHA1e920212b9a3f30fede245ac7addd45cd76dffec6
SHA25625f79f951c7f02156727ad90829100fd5240416ee1db2fa291805cd74a6ae274
SHA512ceeb3ac1ef2add8c5ab6c47db561d2790fd25227b5561789b2c172ec686e2ff99f77c31338b5df7c3543939e11e96f2808723dc72d5e63a51fdefae44f969a69
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
Filesize381KB
MD50811b25e0449e04f782127bc6f8ac5e3
SHA1dc1766e20ee338b12fa80e3ce0052ef97ddf9e20
SHA25620d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c
SHA512a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\74054b5793bfb8c8c0753b4d4aead8e3\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
Filesize947KB
MD5b1aa17d171be82960213057ca35815a9
SHA16c68a8a2c524ddbe04395dfa613378bb311aa314
SHA256c632156c276f9189d0f53addcc1043006d86188e3b74d9c4042ab2110b6cfd4e
SHA5126f042aec9c74da86d15322d4300d93e4a9e69ad3555b302d42d7629dfa060209898b4569a380e9da1a785ddb53a6e0cc0f7543606f17ee467277990971c2fc1a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9a45676b1771806a84f2aaf57d1748da\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize221KB
MD50a4f10f1edf854ec953b5db217894531
SHA15cb5d438f8b0a0478bf81b709342ea9e8bc9cb8e
SHA25615fe58a558faa0792eb0b869ba8e2e196604f1ac6d01935f0b3c28bb2b45c579
SHA512ab30784e3c5f35b7dcecc11e9ba53bf397989d040bc7a3a5f252bf2bcf08dc52e36dfb155541d7fb7e2641adf5c0f8722c6b7ccfb7f55d0235ba224af1df3265
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Filesize483KB
MD5aae5a97685a809d0a0f661f9319f8a12
SHA1b5fdd4ec4cc057fccc868de4f4910be89e23e48a
SHA256c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233
SHA512d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ad7d01564f0056d2476f6ae5d257356b\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
Filesize436KB
MD5748bed51a810c033b91c660b5776ab95
SHA1ec2616fb01949fb9fe4b0eea707f7095b69aa9e4
SHA25645ee38adadeb1586532e8dd4baba14740ccb0801c2e21318c35268543e0ddef7
SHA512dc0cce4c633b8e43d8f6d565fcfc73d79bfea375a79ae5057af6d3cc1b62f929e34c95bcfe2f7d378ec7f421fafdd9ab73cff454df0934e2d2f45a52580e9df0
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\b22777deb45f6aeebf6bc7753dd76eea\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
Filesize220KB
MD55c35887a0b76108f6fb6daac51256ef5
SHA13be6ece2f60d205bcb955a5da0aa182d83cc1899
SHA2569f8de356dab305f2be5cf1f75934eb6b87072e1745ab5ee73ab4b319bb9a2b5a
SHA5120d1d2e5dd3ec776fab85e8f3b8cde32718bbbb52463c2702a17336326570a2fd624b0e32fd98182bba8c25fdd57ba861edebc1f00cfa66c04ec1c8a6f10fcee3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\cb5c0b75d385064e9e51325959cca933\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize305KB
MD5d6a8baf3c9fd81f35dc665df7b10f514
SHA1fbc402d98d05a153a6f68f35f2f5764a6a134d7c
SHA256f383649df9369f491a0c1ba7dceba0808367477659e44e5c3d9e0f4243d20eed
SHA512dc296211d308b4fd5b55f38b9858dc25c3381e6bd1787435cb4d905625abe00713bd7e3a6552e5902adedae0e02590374a90435f029746c9657ad5c9d0df6713
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\daa561280ac1119d9c2694442212aaea\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
Filesize487KB
MD5aefa28d036740086ae52d157f245200a
SHA1d502f55fa76c3cdb69c8ab97321cd9b9a4b68e55
SHA25675127c1e3a30e544413d7eb24fd726bacf8c3a3951ddba1fc990ad00a7f1cc49
SHA5123943c099644525fc2b3a50f843cc1612a003d4f92a9187b2fcecaaf90b33071bced0db4608a91bb59c6bf5d1f6f4eb158881bf78cced0597b7bc3045d9b66ee3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
Filesize124KB
MD5929653b5b019b4555b25d55e6bf9987b
SHA1993844805819ee445ff8136ee38c1aee70de3180
SHA2562766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
Filesize2.1MB
MD510b5a285eafccdd35390bb49861657e7
SHA162c05a4380e68418463529298058f3d2de19660d
SHA2565f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA51219ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
Filesize88KB
MD51f394b5ca6924de6d9dbfb0e90ea50ef
SHA14e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA2569db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
-
Filesize
2.0MB
MD50fba738895f2173ace58c3031d973a60
SHA11be773757465463b0759eeb4ce6ce379841fed71
SHA256fee25a6b5ebb76f96c1cc847071e55c2adb81438659d4d7d8feabde3154a090c
SHA512f8f4b5af474abf0ec4862116e855f2c9075914784c3496c05d4b75f2cbf8e0b3f02d40450e5be1561daa622bdc20ae2e22f81bbda7bc023f8802d8108f9ba007
-
Filesize
648KB
MD53b2e813d9bac28da503db362fa8e384c
SHA145b0514974528847f79b1af9ce53e9a91e115739
SHA2560cdfb3876ae575ca75b29e5a54e32fb4c257f002afb020404c482543237f364e
SHA51254f7b35eb8aa718f42be00543650cb2e0cc59d84c6e27ee10e3669701e6ee789c1157c82481d999e1fc776c72d12ba4a41f1b7dac619c2b9669f97ba86b6a8ed
-
Filesize
577KB
MD561ac34a32bb8b4ec0180b6368f384dd3
SHA1f4102b97c5faaba1d8e6264feb5d433e1bcd73ff
SHA25618d9076af46607ad876ec88f6587300b4fbf308413948fdb1114cce963f8a98b
SHA512eb35f00b7ec05c48793434c62805966d5b167ef7ac160e722d38550fcd140796866edeea1aebfafb1744a42a7562a3a296533ae31198e11eba61f455262fcf61
-
Filesize
705KB
MD57ace53a44805a29900025f15f33faa49
SHA1088b10180caab460354ccbfb6b0581ef10e1f93f
SHA256af497b8ee3deca3bb5bb8548b72771e41458ba2b5844f7f8178bf810f5accb70
SHA512cc6e98e3b631aa88c8e742f54fe2bf1a80cc23c567ee7076dbd768dfc1a88da8dcb38621d602fdde837e9190cb26f2d6d1a90de96855858165295785eac5a76f
-
Filesize
691KB
MD59bb584456c722d012208d768a314844a
SHA18c50418eff7f33d2b111f9e27d2ec6c69cd7e502
SHA256e5f674b1d53e150d057d08d6090a8add12a8f5d2454b369536fec277eb430525
SHA512700b7da782283226a341beab5596d0b1626966b6eb2f6f93198d43a0791885c3a46724e0cbd274c00cdbb7fb25f149ec1202c3891c7bf0c5ec79168664a1754d
-
Filesize
581KB
MD5d443b608d00bf5e3ee66c03705647604
SHA1306a4ed1706f45961cde4069b45581d5d3e4b7c8
SHA25620deb051dca8329e0b3725f0ed5a6f28fda5979ff2ab50faae5c15666a37b933
SHA512a8fee93cf283ba6678c317dae411c4e0c7a19809d8508580910f557ee8793313d33f48d8b6b4fe31636cffb244c8979f22e9f2811a6b5794998e0e819b7b2929
-
Filesize
765KB
MD5c72146c9b84cb734419436940e5b95d0
SHA149ab8d3a078884b387c1e2b12cf3549af34de33d
SHA2562ce44bad3b33ce8518bccd107cdc0c5c78ea0a86f5bfa2efb0916e1cd0d787e9
SHA512c5f2c8de023f0ed45659281fe43721280d0343bfcc899eed635ba90b2fc9e8b6e6b83b8da42d0c3a16269c12fa5302e75eb26bc881decdc2510ea5405c3ee180
-
Filesize
2.0MB
MD553b6d1916b12dca661f2c05e5478084d
SHA13d2d272a856cc65139a06bca2603c66e46f37362
SHA25685a5e5834683927505419d72ccf087b6bac783d7d5b90274b26b83a15921ccd0
SHA512697dd480da2c3ffaf756126c9dce21434d7efc3c0707c1c714dc7262f4cc80c021cc705781d35a41769d00ae8cb8cfdc308fbda95634d28355088f9aa39e9554
-
Filesize
1.2MB
MD5f76b431ea9f37bc38e78cee1709c3b77
SHA16b0ead697ecca2b5ed6b4d477438fa9baea1c006
SHA256d7e1fa6190f4e42f6d94f0bfe6a364c5262c5a360a5a1448809e91722cc0c15c
SHA5122e3283fb5b8ec30fed81c03cc1f751c5f75f8bc7c5fbe8ee5faefe4576576c6607198486ecb538a22522ec50281c69c8c67d540797dd021fd175ed34f469c897
-
Filesize
691KB
MD5d595841218587e59019587adb90e479d
SHA1ace9ce73c05e1d076eca210e59e9cb880fe802cd
SHA2565b31f8cc244fb77a2019958c3f0764365cfffff3cf7748c842f73253756750da
SHA512d4a05cdda799f94222fb2ffacf92c1f6555992bfece524ff6828f284bd0eedfda8ceafc64864f2b49378e066cc1a2f356f33e720b772062ab1a720365936f634