Analysis
- user interaction
yes - max time kernel
770s - max time network
1052s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/07/2026, 22:14
General
- Target AnyDesk (1).exe
- Size 8.0MB
- Sample260720-15tkhsfx6q
- SHA256 46872febd9684df716d392b457aef6611ae7b8716d2ece6bca30fb97271bce1d
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
- Modifies security service 2 TTPs 4 IoCs
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 3 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 27 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 1 IoCs
- Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
- Stops running service(s) 4 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file 2 IoCs
- Modifies Windows Firewall 2 TTPs 24 IoCs
- Power Settings 1 TTPs 63 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 45 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 44 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 36 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 22 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-service2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --backend3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-control2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xf4,0xf8,0x7ffb1f8cc728,0x7ffb1f8cc734,0x7ffb1f8cc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,14825238141906154128,15080999242461107964,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,7173252649169356569,3403607193316730016,262144 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,9956266313736890648,2202756591554082087,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2460 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15952985700967655022,18053858916777017432,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,17659100307971917101,14442044757083840531,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,9983446423373555734,15611263320448944504,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,5886149607395451412,13425398036704299036,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4964,i,4436063243410473736,14328017556492591245,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,2671081101416749293,2439421186711104671,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,2355420901786358423,628089212197451861,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,16261267094112853040,9756669174400952584,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,2387079823838278740,1663757782550211872,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6392 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,12650575420790297940,6510066502511650894,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Quavo-Setup.exe"C:\Users\Admin\Downloads\Quavo-Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4460,i,4853002457190772448,17116525598766146434,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6012,i,1705505518080294714,5254650958915413062,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5100 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4972,i,4682536729947808801,8236955965552993562,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5124,i,5350325090594189805,18097992210881688463,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5956,i,9127893362476237827,11549219584461722858,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6464,i,893209687202104253,2198840328435529835,2097152 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,15170850307839126625,1007847785203509973,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6516 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\VossSetup.exe"C:\Users\Admin\Downloads\VossSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M9QRPTZPFB.tmp\VossSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-M9QRPTZPFB.tmp\VossSetup.tmp" /SL5="$9030E,20180939,854528,C:\Users\Admin\Downloads\VossSetup.exe"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Voss\Voss.exe"C:\Program Files\Voss\Voss.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5988,i,3614253805280508946,13946494463857400403,262144 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,9109976045318090304,2180101773730140225,524288 --field-trial-handle=2140,i,10517639061435516286,10505988520148020082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Voss\Voss.exe"C:\Program Files\Voss\Voss.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\VossScripts\voss_apply.ps1 -DisableDefender -ApplyVisualFx -DisablePrintScreen2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Drops file in Drivers directory
- Boot or Logon Autostart Execution: LSASS Driver
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41384711-CF33-479E-B3CF-82E2D2B3E7A0\dismhost.exeC:\Users\Admin\AppData\Local\Temp\41384711-CF33-479E-B3CF-82E2D2B3E7A0\dismhost.exe {E6B0B6ED-92CB-4AF7-86E0-ADE9748809F1}3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\78EDB9E2-6D0E-4641-8CAD-B55749912E76\dismhost.exeC:\Users\Admin\AppData\Local\Temp\78EDB9E2-6D0E-4641-8CAD-B55749912E76\dismhost.exe {8DC8669E-51BA-401A-B11C-9CD7E13F80AA}3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\86E35F78-05C6-4C35-822A-8C28C235FD68\dismhost.exeC:\Users\Admin\AppData\Local\Temp\86E35F78-05C6-4C35-822A-8C28C235FD68\dismhost.exe {1D71C92E-3D36-4A0F-8A3F-807E39251BDC}3⤵
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\5A9D920A-00D9-4973-A0A4-963FC196C110\dismhost.exeC:\Users\Admin\AppData\Local\Temp\5A9D920A-00D9-4973-A0A4-963FC196C110\dismhost.exe {A4FAE5FD-5B49-4AE2-919D-602EDBAA3170}3⤵
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\CDEC7FC7-0F8D-45C7-9B8A-40DE5410373B\dismhost.exeC:\Users\Admin\AppData\Local\Temp\CDEC7FC7-0F8D-45C7-9B8A-40DE5410373B\dismhost.exe {88700179-DC00-43D5-9732-DC5025E9853F}3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\D088E232-B9B2-4D95-A7AE-711B86C6E8D9\dismhost.exeC:\Users\Admin\AppData\Local\Temp\D088E232-B9B2-4D95-A7AE-711B86C6E8D9\dismhost.exe {037E292C-9869-4194-A90C-8EB746AD1B83}3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\366CE622-3A14-45C1-BFFD-9A7D537382FE\dismhost.exeC:\Users\Admin\AppData\Local\Temp\366CE622-3A14-45C1-BFFD-9A7D537382FE\dismhost.exe {28EB67DB-4B65-4FF2-8EF6-DBD8DDE1E921}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2C4DE35F-3C2B-4C3E-960F-D0D3673EB9D0\dismhost.exeC:\Users\Admin\AppData\Local\Temp\2C4DE35F-3C2B-4C3E-960F-D0D3673EB9D0\dismhost.exe {F30E85DA-4729-47EC-BD52-4338350146F9}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2908A6A4-F4A9-4629-B27A-FB04C67C64F0\dismhost.exeC:\Users\Admin\AppData\Local\Temp\2908A6A4-F4A9-4629-B27A-FB04C67C64F0\dismhost.exe {EDCFDF7F-2AC2-4988-8562-24A567381A04}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\289358B6-6D69-4EFD-AA06-BB1F6E62E234\dismhost.exeC:\Users\Admin\AppData\Local\Temp\289358B6-6D69-4EFD-AA06-BB1F6E62E234\dismhost.exe {7F21458A-7271-47AD-995B-5E393C73281D}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2CC458C2-0C0F-420C-8264-EC3A21842B82\dismhost.exeC:\Users\Admin\AppData\Local\Temp\2CC458C2-0C0F-420C-8264-EC3A21842B82\dismhost.exe {A5E9DCE7-F29C-4ACF-A522-9603AB40D41F}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\D9BD6321-0528-4469-942A-C22767140696\dismhost.exeC:\Users\Admin\AppData\Local\Temp\D9BD6321-0528-4469-942A-C22767140696\dismhost.exe {57420A56-E553-46B1-9F2D-BF5FEBD6CCB5}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\10EBF433-8B83-4FAA-A443-723A84A3A790\dismhost.exeC:\Users\Admin\AppData\Local\Temp\10EBF433-8B83-4FAA-A443-723A84A3A790\dismhost.exe {67575D68-DE19-413F-992C-20FB693E5A9C}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2F899256-54F5-4230-9E4D-EB1135232AC8\dismhost.exeC:\Users\Admin\AppData\Local\Temp\2F899256-54F5-4230-9E4D-EB1135232AC8\dismhost.exe {09518B7D-8662-46DB-B21F-31E6C3217D4B}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\C42FA01B-96C9-47C6-BAF8-080894809D4D\dismhost.exeC:\Users\Admin\AppData\Local\Temp\C42FA01B-96C9-47C6-BAF8-080894809D4D\dismhost.exe {2F1416DF-752D-45D3-A284-5C1C318A7165}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\F6131B27-4658-444E-B58C-7C5E089FCE9A\dismhost.exeC:\Users\Admin\AppData\Local\Temp\F6131B27-4658-444E-B58C-7C5E089FCE9A\dismhost.exe {B6D86E52-CCC8-4123-95B2-2F4F2825CF82}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\62EAB2A5-ACE6-4001-BBBF-24F7EFA477CA\dismhost.exeC:\Users\Admin\AppData\Local\Temp\62EAB2A5-ACE6-4001-BBBF-24F7EFA477CA\dismhost.exe {15801398-C90E-45FE-B74E-BFC2004278DA}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\0C052831-2D13-40B8-93A2-2D17F00F98C9\dismhost.exeC:\Users\Admin\AppData\Local\Temp\0C052831-2D13-40B8-93A2-2D17F00F98C9\dismhost.exe {FF9F05CF-7007-4ABB-B81D-44B7E71CA53B}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DB1070F3-AF63-4FD3-BECF-13FAEF2A7D4D\dismhost.exeC:\Users\Admin\AppData\Local\Temp\DB1070F3-AF63-4FD3-BECF-13FAEF2A7D4D\dismhost.exe {2E66975C-ED8E-492D-ADB6-40451DEAA970}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\039CBA13-1499-4806-B302-56517955166C\dismhost.exeC:\Users\Admin\AppData\Local\Temp\039CBA13-1499-4806-B302-56517955166C\dismhost.exe {214F9925-236C-4046-8F4E-A1CFB9A92EA1}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\090B5E70-29BF-478D-B026-1CD458826B63\dismhost.exeC:\Users\Admin\AppData\Local\Temp\090B5E70-29BF-478D-B026-1CD458826B63\dismhost.exe {1A3BB00C-FDC6-4414-8D0F-2D46B8C8A765}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\D411F343-0E57-46CC-8FBE-D3F72005B9C4\dismhost.exeC:\Users\Admin\AppData\Local\Temp\D411F343-0E57-46CC-8FBE-D3F72005B9C4\dismhost.exe {A9935E76-8A26-4ACE-BF28-80BA8D75A903}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\F6CE5CBD-D8AA-4F6F-85C0-B63CE89ABD22\dismhost.exeC:\Users\Admin\AppData\Local\Temp\F6CE5CBD-D8AA-4F6F-85C0-B63CE89ABD22\dismhost.exe {8FFA2A4F-E053-4AE5-9EBC-EFD816324313}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop OneSyncSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop TrkWks3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop DiagnosticHub.StandardCollector.ServiceX3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop diagnosticshub.standardcollector.service3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop WerSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop wercplsupport3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop UCPD3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop NetBT3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop Telemetry3⤵
- Launches sc.exe
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set disabledynamictick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set useplatformtick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set tscsyncpolicy enhanced3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global autotuninglevel=normal3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global ecncapability=disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn "\Microsoft\Windows\Application Experience\MareBackup" /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity" /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn \Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn \Microsoft\Windows\Maintenance\WinSAT /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn \Microsoft\Windows\PI\Sqm-Tasks /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn \Microsoft\Windows\NetTrace\GatherNetworkInfo /disable3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /change /tn \Microsoft\Windows\WDI\ResolutionHost /disable3⤵
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb613⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -list3⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setactive a02dcd46-05ed-4c2f-9ac3-b6623a4704173⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -h off3⤵
- Power Settings
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set disabledynamictick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set useplatformtick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /deletevalue useplatformclock3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global rss=enabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global chimney=disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global ecncapability=enabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set supplemental internet congestionprovider=ctcp3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set bootmenupolicy legacy3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set debug off3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set bootdebug off3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set ems off3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORESPOLICY 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\fsutil.exe"C:\Windows\system32\fsutil.exe" behavior set disable8dot3 13⤵
-
-
C:\Windows\system32\fsutil.exe"C:\Windows\system32\fsutil.exe" behavior set disablelastaccess 13⤵
-
-
C:\Windows\system32\fsutil.exe"C:\Windows\system32\fsutil.exe" behavior set encryptpagingfile 03⤵
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set hypervisorlaunchtype off3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set quietboot yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 5d76a2ca-e8c0-402f-a133-2158492d58ad 13⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 5d76a2ca-e8c0-402f-a133-2158492d58ad 13⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Application Experience\AitAgent" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Autochk\Proxy /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Feedback\Siuf\DmClient /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Office\OfficeTelemetryAgentFallBack /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Office\OfficeTelemetryAgentLogOn /DISABLE3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\B5F81850-E862-4369-8910-0D8DA15F0A1A\dismhost.exeC:\Users\Admin\AppData\Local\Temp\B5F81850-E862-4369-8910-0D8DA15F0A1A\dismhost.exe {E43EDAAB-88C6-41A5-97C9-3373114F323B}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\201A127C-0003-4606-81A7-299766380F39\dismhost.exeC:\Users\Admin\AppData\Local\Temp\201A127C-0003-4606-81A7-299766380F39\dismhost.exe {FE50EEB3-0EC8-427D-9D74-C66DFD03FF35}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\6BC8BA0F-2746-4340-8593-768BCE68D0E7\dismhost.exeC:\Users\Admin\AppData\Local\Temp\6BC8BA0F-2746-4340-8593-768BCE68D0E7\dismhost.exe {712716E7-2A0A-474C-B26D-40895D121520}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\8E346202-1C2D-4938-BDEC-849D24184821\dismhost.exeC:\Users\Admin\AppData\Local\Temp\8E346202-1C2D-4938-BDEC-849D24184821\dismhost.exe {FE966F16-D811-4997-862E-6041191831A5}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\EEA927CF-DE61-460A-968D-A9518CF0437F\dismhost.exeC:\Users\Admin\AppData\Local\Temp\EEA927CF-DE61-460A-968D-A9518CF0437F\dismhost.exe {2816F41A-7A3A-4C7F-9F4A-C2D1BF31C74F}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Defrag\ScheduledDefrag /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\TaskScheduler\Regular Maintenance" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\TaskScheduler\Maintenance Configurator" /DISABLE3⤵
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_SLEEP STANDBYIDLE 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_SLEEP STANDBYIDLE 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64" /DISABLE3⤵
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -h off3⤵
- Power Settings
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set useplatformtick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set disabledynamictick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set tscsyncpolicy enhanced3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /DISABLE3⤵
-
-
C:\Windows\system32\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int teredo set state disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int 6to4 set state disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int isatap set state disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global ecncapability=disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global timestamps=disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Time Discovery
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change monitor-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change monitor-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change disk-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /change disk-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Shell\FamilySafetyMonitor /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Shell\FamilySafetyRefresh /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Maps\MapsToastTask /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN \Microsoft\Windows\Maps\MapsUpdateTask /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /DISABLE3⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Change /TN "\Microsoft\Windows\Device Information\Device" /DISABLE3⤵
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Users\Admin\AppData\Local\Temp\C0E44B72-D524-4A5A-8665-E17974019BEF\dismhost.exeC:\Users\Admin\AppData\Local\Temp\C0E44B72-D524-4A5A-8665-E17974019BEF\dismhost.exe {E9B536DE-F326-456B-BCFF-BA7256BB6C84}3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFBOOSTMODE 23⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFBOOSTMODE 23⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_65.52.100.7 dir=out action=block remoteip=65.52.100.73⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_65.52.100.9 dir=out action=block remoteip=65.52.100.93⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_65.52.108.33 dir=out action=block remoteip=65.52.108.333⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_65.55.252.92 dir=out action=block remoteip=65.55.252.923⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_64.4.54.254 dir=out action=block remoteip=64.4.54.2543⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_68.232.34.200 dir=out action=block remoteip=68.232.34.2003⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_191.236.155.80 dir=out action=block remoteip=191.236.155.803⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_65.55.56.48 dir=out action=block remoteip=65.55.56.483⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_65.55.252.71 dir=out action=block remoteip=65.55.252.713⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_131.253.33.200 dir=out action=block remoteip=131.253.33.2003⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_184.86.53.99 dir=out action=block remoteip=184.86.53.993⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_2.22.61.43 dir=out action=block remoteip=2.22.61.433⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_2.22.61.44 dir=out action=block remoteip=2.22.61.443⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_204.79.197.200 dir=out action=block remoteip=204.79.197.2003⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_23.218.212.69 dir=out action=block remoteip=23.218.212.693⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_8.254.209.254 dir=out action=block remoteip=8.254.209.2543⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_157.56.106.189 dir=out action=block remoteip=157.56.106.1893⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_157.56.91.77 dir=out action=block remoteip=157.56.91.773⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_134.170.115.60 dir=out action=block remoteip=134.170.115.603⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_134.170.58.121 dir=out action=block remoteip=134.170.58.1213⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_204.79.197.200 dir=out action=block remoteip=204.79.197.2003⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_207.46.223.94 dir=out action=block remoteip=207.46.223.943⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=VossBlock_65.52.38.114 dir=out action=block remoteip=65.52.38.1143⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFBOOSTPOL 23⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFBOOSTPOL 23⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR AUTONOMOUSMODE 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR AUTONOMOUSMODE 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\fsutil.exe"C:\Windows\system32\fsutil.exe" behavior set DisableDeleteNotify 03⤵
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall set rule "group=Remote Assistance" new enable=no3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" fthsvc.dll,FthSysprepSpecialize3⤵
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-SleepStudy/Diagnostic /e:false3⤵
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-Kernel-Processor-Power/Diagnostic /e:false3⤵
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-UserModePowerService/Diagnostic /e:false3⤵
-
-
C:\Windows\system32\w32tm.exe"C:\Windows\system32\w32tm.exe" /config /syncfromflags:manual "/manualpeerlist:0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org"3⤵
-
-
C:\Windows\system32\w32tm.exe"C:\Windows\system32\w32tm.exe" /config /update3⤵
-
-
C:\Windows\system32\w32tm.exe"C:\Windows\system32\w32tm.exe" /resync /force3⤵
-
-
C:\Windows\system32\lodctr.exe"C:\Windows\system32\lodctr.exe" /r3⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\lodctr.exe"C:\Windows\system32\lodctr.exe" /r3⤵
- Drops file in System32 directory
-
-
C:\Windows\System32\Wbem\WinMgmt.exe"C:\Windows\System32\Wbem\WinMgmt.exe" /resyncperf3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F4⤵
-
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /Online /Set-ReservedStorageState /State:Disabled3⤵
-
C:\Users\Admin\AppData\Local\Temp\2E5DF3FA-01A4-4DC5-BE19-C2A21A3538E4\dismhost.exeC:\Users\Admin\AppData\Local\Temp\2E5DF3FA-01A4-4DC5-BE19-C2A21A3538E4\dismhost.exe {6BC0992C-6017-40CD-B07B-FC21DD2ED9D6}4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 0012ee47-9041-4b5d-9b77-535fba8b1442 d3d55efd-c1ff-424e-9dc3-441be7833010 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 0012ee47-9041-4b5d-9b77-535fba8b1442 d639518a-e56d-4345-8af2-b9f32fb26109 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 0012ee47-9041-4b5d-9b77-535fba8b1442 fc7372b6-ab2d-43ee-8797-15e9841f2cca 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 0853a681-27c8-4100-a2fd-82013e970683 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 d4e98f31-5ffe-4ce1-be31-1b38b384c009 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 3b04d4fd-1cc7-4f23-ab1c-d1337819c4bb 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 4d2b0152-7d5c-498b-88e2-34345392a2c5 2003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 258 -Pipe 26c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 1d4 -Pipe 280 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 1b8 -Pipe 288 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 268 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 274 -Pipe 294 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 0 -NGENProcess 294 -Pipe 2c0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 2a0 -Pipe 1b8 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 0 -NGENProcess 2a0 -Pipe 258 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 0 -NGENProcess 274 -Pipe 2c8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2b0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 294 -Pipe 274 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2a0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 1d4 -Pipe 2a0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 258 -Pipe 2fc -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2a4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 258 -Pipe 2dc -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 294 -Pipe 2dc -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 28c -Pipe 2f8 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 304 -Pipe 258 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2d0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2fc -Pipe 1d4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2a8 -Pipe 304 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1b4 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c4 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1c4 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 0 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 268 -Pipe 278 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 2d0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 0 -NGENProcess 280 -Pipe 2c0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 258 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 0 -NGENProcess 2a0 -Pipe 274 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 268 -Pipe 2b4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 268 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 0 -NGENProcess 250 -Pipe 2d4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 280 -Pipe 2a0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 0 -NGENProcess 280 -Pipe 2f4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2d8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 2b4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2dc -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 29c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2cc -Pipe 2e0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 25c -Pipe 26c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\Microsoft.Dism.PowerShell.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1b4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Windows.Appx.PackageManager.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.Appx.PackageManager.Commands.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 1c4 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 26c -Pipe 25c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 0 -NGENProcess 270 -Pipe 278 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 254 -Pipe 260 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2b0 -Pipe 270 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 2c0 -Pipe 288 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 2cc -Pipe 2a8 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2d0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2c0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 274 -Pipe 2b8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2e4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 2ac -Pipe 274 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2d4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 2ac -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 270 -Pipe 290 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 280 -Pipe 2c4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2fc -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 1b8 -Pipe 280 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 270 -Pipe 2fc -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2b4 -Pipe 270 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 300 -Pipe 304 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 30c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 26c -Pipe 2e0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 0 -NGENProcess 2cc -Pipe 28c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WinMetadata\Windows.Management.winmd3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WinMetadata\Windows.Foundation.winmd3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1c4 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 0 -NGENProcess 1c0 -Pipe 1b4 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WinMetadata\Windows.ApplicationModel.winmd3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.WindowsRuntime\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.WindowsRuntime.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WinMetadata\Windows.System.winmd3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 0 -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DnsClient\dnslookup.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 0 -NGENProcess 1c4 -Pipe 26c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 27c -Pipe 284 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 0 -NGENProcess 2ac -Pipe 1c4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 2b0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2bc -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 0 -NGENProcess 280 -Pipe 2d4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 274 -Pipe 1d8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2d0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2ec -Pipe 2b4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 274 -Pipe 2b0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2e0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2c0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2ac -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2a0 -Pipe 1d8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 308 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\Microsoft.Net\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetSecurity\Microsoft.Windows.Firewall.Commands.dll3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 0 -NGENProcess 1c4 -Pipe 274 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cleanmgr.exe"C:\Windows\system32\cleanmgr.exe" /sagerun:643⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\CC80130D-B971-4B46-AEAE-74404E7E3FB9\dismhost.exeC:\Users\Admin\AppData\Local\Temp\CC80130D-B971-4B46-AEAE-74404E7E3FB9\dismhost.exe {872F6064-8AF4-4AE5-A05B-044680D73874}4⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /timeout 103⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /Online /Remove-Capability /CapabilityName:App.StepsRecorder~~~~0.0.1.0 /NoRestart3⤵
-
C:\Users\Admin\AppData\Local\Temp\8F426986-D5FE-45C0-A905-2D98D07C0FB4\dismhost.exeC:\Users\Admin\AppData\Local\Temp\8F426986-D5FE-45C0-A905-2D98D07C0FB4\dismhost.exe {2EA2A037-773F-4D3C-AD87-13C5366DF121}4⤵
-
-
-
C:\Windows\system32\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /enable3⤵
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /list3⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive e9a42b02-d5df-448d-aa00-03f14749eb613⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb613⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive de73a5b4-fc99-4a52-9662-a0912a2dd2b33⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /changename de73a5b4-fc99-4a52-9662-a0912a2dd2b3 "Ultimate Performance"3⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 1003⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP STANDBYIDLE 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATEIDLE 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_DISK DISKIDLE 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" winsock reset3⤵
-
-
C:\Windows\system32\auditpol.exe"C:\Windows\system32\auditpol.exe" /set /category:* /success:disable /failure:disable3⤵
-
-
C:\Windows\system32\fsutil.exe"C:\Windows\system32\fsutil.exe" behavior set disableLastAccess 13⤵
-
-
C:\Windows\system32\fsutil.exe"C:\Windows\system32\fsutil.exe" behavior set disable8dot3 13⤵
-
-
C:\Windows\system32\fsutil.exe"C:\Windows\system32\fsutil.exe" behavior set memoryusage 23⤵
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set disabledynamictick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set useplatformtick yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set x2apicpolicy enable3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set usefirmwarepcisettings no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT3⤵
- Power Settings
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global rsc=disabled3⤵
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global autotuninglevel=disabled3⤵
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global initialRto=20003⤵
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global ecncapability=disabled3⤵
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global dca=enabled3⤵
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" int tcp set global timestamps=disabled3⤵
- System Time Discovery
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set watchdog disable3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set tscsyncpolicy enhanced3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set vsmlaunchtype Off3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /timeout 03⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set quietboot yes3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Users\Admin\AppData\Local\Temp\5CA5714F-4202-4C86-9702-30922412C8E1\dismhost.exeC:\Users\Admin\AppData\Local\Temp\5CA5714F-4202-4C86-9702-30922412C8E1\dismhost.exe {87A81D56-D165-44EB-A359-6C6FF382D263}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\95E4B319-771E-415E-AD59-3034E213002D\dismhost.exeC:\Users\Admin\AppData\Local\Temp\95E4B319-771E-415E-AD59-3034E213002D\dismhost.exe {60F92D33-BA5D-4B27-BCC1-3B187042DA15}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\707611D0-350D-4D9D-9FDA-2DDD4C96FF0A\dismhost.exeC:\Users\Admin\AppData\Local\Temp\707611D0-350D-4D9D-9FDA-2DDD4C96FF0A\dismhost.exe {F643E149-9B32-4521-87BC-38C4D9FFBD60}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\B69E9B24-437F-4E9F-97B8-5318BCB460D1\dismhost.exeC:\Users\Admin\AppData\Local\Temp\B69E9B24-437F-4E9F-97B8-5318BCB460D1\dismhost.exe {4B6BE7F6-F071-40B3-AFA7-D6CD651BE9C5}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\748212AE-EBAD-4759-B09F-D38DB66B60ED\dismhost.exeC:\Users\Admin\AppData\Local\Temp\748212AE-EBAD-4759-B09F-D38DB66B60ED\dismhost.exe {1893C587-BEC6-4294-AF3C-22313EC10978}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\86641BC4-57D6-4998-9054-8EF0CE801D0C\dismhost.exeC:\Users\Admin\AppData\Local\Temp\86641BC4-57D6-4998-9054-8EF0CE801D0C\dismhost.exe {2DCD0D70-9521-42D8-9FFF-3DCFB65B985D}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9240CF0D-85D3-4E03-A768-084C7080C071\dismhost.exeC:\Users\Admin\AppData\Local\Temp\9240CF0D-85D3-4E03-A768-084C7080C071\dismhost.exe {23CA930E-BF8E-47EA-83D9-1395B1282399}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\744A2D19-560E-439A-95BD-EFC6FC2A7F39\dismhost.exeC:\Users\Admin\AppData\Local\Temp\744A2D19-560E-439A-95BD-EFC6FC2A7F39\dismhost.exe {7D596CB4-21A6-41F3-80F1-FC0594DC3824}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\87FCD8B6-9A53-4528-B942-63C60D02D275\dismhost.exeC:\Users\Admin\AppData\Local\Temp\87FCD8B6-9A53-4528-B942-63C60D02D275\dismhost.exe {F6D9F3BB-E07F-4584-93C4-56B3E4D03743}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\464E1CBB-ED0E-4096-8BBE-FE3F50104BD0\dismhost.exeC:\Users\Admin\AppData\Local\Temp\464E1CBB-ED0E-4096-8BBE-FE3F50104BD0\dismhost.exe {CD7CD3FE-AC85-4A42-95EA-B3D23D97ACEF}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5C52EC6E-5484-47A5-B82C-076C8DC5F74E\dismhost.exeC:\Users\Admin\AppData\Local\Temp\5C52EC6E-5484-47A5-B82C-076C8DC5F74E\dismhost.exe {E254CA83-7289-48CE-BCEA-E1CEB6ECA9A5}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9E7CCB1F-1256-4A2E-8C67-D41D7BEF30E8\dismhost.exeC:\Users\Admin\AppData\Local\Temp\9E7CCB1F-1256-4A2E-8C67-D41D7BEF30E8\dismhost.exe {628A68F6-7C45-4580-9DAD-E4525430BF7F}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5498239D-590E-419C-B8F6-C1ED32A56814\dismhost.exeC:\Users\Admin\AppData\Local\Temp\5498239D-590E-419C-B8F6-C1ED32A56814\dismhost.exe {6088111B-9581-4064-B5FB-4E39965FFE97}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3D19711A-DC45-4715-98F9-8C23F4CBF7EE\dismhost.exeC:\Users\Admin\AppData\Local\Temp\3D19711A-DC45-4715-98F9-8C23F4CBF7EE\dismhost.exe {35CD7A43-1C79-4BDB-A19A-B628DAC8F073}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\71F83BA4-9B79-4766-ABEC-099B00C6A440\dismhost.exeC:\Users\Admin\AppData\Local\Temp\71F83BA4-9B79-4766-ABEC-099B00C6A440\dismhost.exe {E924500E-052E-4A1E-9E35-9CEC53175855}3⤵
-
-
-
C:\Windows\system32\SystemPropertiesPerformance.exe"C:\Windows\system32\SystemPropertiesPerformance.exe"1⤵
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\system32\SystemPropertiesPerformance.exe"C:\Windows\system32\SystemPropertiesPerformance.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Indicator Removal
2File Deletion
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6OpenGL.dll
Qt6OpenGLWidgets.dll
Qt6Widgets.dll
Voss.exe
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00000e
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe59f255.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
File Explorer.lnk
Microsoft Edge.lnk
DismHost.exe
AppxProvider.dll
AssocProvider.dll
CbsProvider.dll
DismCore.dll
DismCorePS.dll
DismProv.dll
DmiProvider.dll
FfuProvider.dll
FolderProvider.dll
GenericProvider.dll
IBSProvider.dll
ImagingProvider.dll
IntlProvider.dll
LogProvider.dll
MsiProvider.dll
OSProvider.dll
OfflineSetupProvider.dll
ProvProvider.dll
SetupPlatformProvider.dll
SmiProvider.dll
SysprepProvider.dll
TransmogProvider.dll
UnattendProvider.dll
VhdProvider.dll
WimProvider.dll
AppxProvider.dll.mui
AssocProvider.dll.mui
CbsProvider.dll.mui
DismCore.dll.mui
DismProv.dll.mui
DmiProvider.dll.mui
FfuProvider.dll.mui
FolderProvider.dll.mui
GenericProvider.dll.mui
ImagingProvider.dll.mui
IntlProvider.dll.mui
LogProvider.dll.mui
MsiProvider.dll.mui
OSProvider.dll.mui
OfflineSetupProvider.dll.mui
ProvProvider.dll.mui
SetupPlatformProvider.dll.mui
SmiProvider.dll.mui
TransmogProvider.dll.mui
UnattendProvider.dll.mui
VhdProvider.dll.mui
WimProvider.dll.mui
AppxProvider.dll.mui
AssocProvider.dll.mui
CbsProvider.dll.mui
DismCore.dll.mui
DismProv.dll.mui
DmiProvider.dll.mui
FfuProvider.dll.mui
FolderProvider.dll.mui
GenericProvider.dll.mui
IBSProvider.dll.mui
ImagingProvider.dll.mui
IntlProvider.dll.mui
LogProvider.dll.mui
MsiProvider.dll.mui
OSProvider.dll.mui
OfflineSetupProvider.dll.mui
ProvProvider.dll.mui
SetupPlatformProvider.dll.mui
SmiProvider.dll.mui
SysprepProvider.dll.mui
TransmogProvider.dll.mui
UnattendProvider.dll.mui
VhdProvider.dll.mui
WimProvider.dll.mui
AppxProvider.dll.mui
AssocProvider.dll.mui
CbsProvider.dll.mui
DismCore.dll.mui
DismProv.dll.mui
DmiProvider.dll.mui
FfuProvider.dll.mui
FolderProvider.dll.mui
GenericProvider.dll.mui
ImagingProvider.dll.mui
IntlProvider.dll.mui
LogProvider.dll.mui
MsiProvider.dll.mui
OSProvider.dll.mui
OfflineSetupProvider.dll.mui
ProvProvider.dll.mui
SetupPlatformProvider.dll.mui
SmiProvider.dll.mui
TransmogProvider.dll.mui
UnattendProvider.dll.mui
VhdProvider.dll.mui
WimProvider.dll.mui
AppxProvider.dll.mui
AssocProvider.dll.mui
CbsProvider.dll.mui
DismCore.dll.mui
DismProv.dll.mui
DmiProvider.dll.mui
FfuProvider.dll.mui
FolderProvider.dll.mui
GenericProvider.dll.mui
ImagingProvider.dll.mui
IntlProvider.dll.mui
LogProvider.dll.mui
MsiProvider.dll.mui
OSProvider.dll.mui
OfflineSetupProvider.dll.mui
ProvProvider.dll.mui
SetupPlatformProvider.dll.mui
SmiProvider.dll.mui
TransmogProvider.dll.mui
UnattendProvider.dll.mui
VhdProvider.dll.mui
WimProvider.dll.mui
AppxProvider.dll.mui
AssocProvider.dll.mui
CbsProvider.dll.mui
DismCore.dll.mui
DismProv.dll.mui
DmiProvider.dll.mui
FfuProvider.dll.mui
FolderProvider.dll.mui
GenericProvider.dll.mui
ImagingProvider.dll.mui
IntlProvider.dll.mui
LogProvider.dll.mui
MsiProvider.dll.mui
OSProvider.dll.mui
OfflineSetupProvider.dll.mui
ProvProvider.dll.mui
SetupPlatformProvider.dll.mui
SmiProvider.dll.mui
TransmogProvider.dll.mui
UnattendProvider.dll.mui
VhdProvider.dll.mui
WimProvider.dll.mui
AppxProvider.dll.mui
AssocProvider.dll.mui
CbsProvider.dll.mui
DismCore.dll.mui
DismProv.dll.mui
DmiProvider.dll.mui
FfuProvider.dll.mui
FolderProvider.dll.mui
GenericProvider.dll.mui
ImagingProvider.dll.mui
IntlProvider.dll.mui
LogProvider.dll.mui
MsiProvider.dll.mui
OSProvider.dll.mui
OfflineSetupProvider.dll.mui
ProvProvider.dll.mui
SetupPlatformProvider.dll.mui
SmiProvider.dll.mui
TransmogProvider.dll.mui
UnattendProvider.dll.mui
VhdProvider.dll.mui
WimProvider.dll.mui
__PSScriptPolicyTest_reg1nbqs.h5j.ps1
gcapi.dll
VossSetup.tmp
StdUtils.dll
System.dll
UAC.dll
nsDialogs.dll
ad.trace
ad.trace
ad.trace
service.conf
service.conf
service.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
dism.log
diagerr.xml
diagwrn.xml
setupact.log
setuperr.log
hosts
perfc007.dat
perfc00A.dat
perfc00C.dat
perfc010.dat
perfc011.dat
perfh007.dat
perfh009.dat
perfh00A.dat
perfh00C.dat
perfh010.dat
perfh011.dat
memory/468-915-0x000002432C9A0000-0x000002432CFED000-memory.dmp
memory/468-901-0x000002432C9A0000-0x000002432CFED000-memory.dmp
memory/468-929-0x000002432C9A0000-0x000002432CFED000-memory.dmp
memory/468-880-0x000002432C9A0000-0x000002432CFED000-memory.dmp
memory/468-933-0x000002432C9A0000-0x000002432CFED000-memory.dmp
memory/852-9573-0x00000208EC500000-0x00000208EC526000-memory.dmp
memory/1384-511-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-562-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-424-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-149-0x0000000006E30000-0x0000000006E4B000-memory.dmp
memory/1384-684-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-150-0x0000000006E30000-0x0000000006E4B000-memory.dmp
memory/1384-742-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-936-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-607-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-146-0x0000000006E30000-0x0000000006E4B000-memory.dmp
memory/1384-926-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-540-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-441-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-890-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-453-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-27-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-461-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1384-457-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-942-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-454-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-685-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-960-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-512-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-462-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-608-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-937-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-458-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-45-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-425-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-927-0x0000000000320000-0x0000000002848000-memory.dmp
memory/1532-442-0x0000000000320000-0x0000000002848000-memory.dmp
memory/2208-564-0x0000000000320000-0x0000000002848000-memory.dmp
memory/2208-450-0x0000000000320000-0x0000000002848000-memory.dmp
memory/2208-455-0x0000000000320000-0x0000000002848000-memory.dmp
memory/2208-437-0x0000000000320000-0x0000000002848000-memory.dmp
memory/2208-724-0x0000000000320000-0x0000000002848000-memory.dmp
memory/2208-480-0x0000000000320000-0x0000000002848000-memory.dmp
memory/2688-9470-0x000002374FEF0000-0x0000023750420000-memory.dmp
memory/3128-961-0x00000192B4BB0000-0x00000192B51FD000-memory.dmp
memory/3128-966-0x00000192B4BB0000-0x00000192B51FD000-memory.dmp
memory/3128-971-0x00000192B4BB0000-0x00000192B51FD000-memory.dmp
memory/3128-948-0x00000192B4BB0000-0x00000192B51FD000-memory.dmp
memory/3128-976-0x00000192B4BB0000-0x00000192B51FD000-memory.dmp
memory/3536-1011-0x00000200BD040000-0x00000200BD06A000-memory.dmp
memory/3536-6347-0x00000200BD4D0000-0x00000200BD4DE000-memory.dmp
memory/3536-1012-0x00000200BD040000-0x00000200BD064000-memory.dmp
memory/3536-1197-0x00000200BD490000-0x00000200BD4B6000-memory.dmp
memory/3536-1195-0x00000200BD090000-0x00000200BD0A6000-memory.dmp
memory/3536-5193-0x00000200BD580000-0x00000200BD590000-memory.dmp
memory/3536-5194-0x00000200BD5B0000-0x00000200BD5CA000-memory.dmp
memory/3536-1010-0x00000200BCE80000-0x00000200BCE8A000-memory.dmp
memory/3536-1016-0x00000200BD060000-0x00000200BD084000-memory.dmp
memory/3536-1196-0x00000200BD0B0000-0x00000200BD0BA000-memory.dmp
memory/3536-986-0x00000200BCE50000-0x00000200BCE72000-memory.dmp
memory/4964-823-0x0000000000670000-0x0000000000AAA000-memory.dmp
memory/4964-886-0x0000000000670000-0x0000000000AAA000-memory.dmp
memory/4964-887-0x0000000000670000-0x0000000000AAA000-memory.dmp
memory/5100-888-0x0000000000490000-0x000000000056F000-memory.dmp
memory/5100-786-0x0000000000490000-0x000000000056F000-memory.dmp
memory/5100-799-0x0000000000490000-0x000000000056F000-memory.dmp
memory/5136-10039-0x0000024C9B490000-0x0000024C9B859000-memory.dmp
memory/5256-9489-0x0000029444250000-0x0000029444270000-memory.dmp
memory/5256-9481-0x0000029443FB0000-0x0000029443FC2000-memory.dmp
memory/5256-9495-0x00000294442D0000-0x00000294442EE000-memory.dmp
memory/5256-9493-0x0000029444670000-0x000002944472A000-memory.dmp
memory/5256-9491-0x00000294443D0000-0x000002944440C000-memory.dmp
memory/5256-9492-0x00000294442B0000-0x00000294442C2000-memory.dmp
memory/5256-9471-0x000002942BE00000-0x000002942BE36000-memory.dmp
memory/5256-9472-0x0000029443FE0000-0x0000029444030000-memory.dmp
memory/5256-9473-0x00000294440F0000-0x00000294441A2000-memory.dmp
memory/5256-9474-0x00000294441B0000-0x0000029444226000-memory.dmp
memory/5256-9475-0x000002942BDD0000-0x000002942BDD8000-memory.dmp
memory/5256-9476-0x0000029444030000-0x000002944406A000-memory.dmp
memory/5256-9477-0x0000029444760000-0x0000029444C88000-memory.dmp
memory/5256-9478-0x0000029444070000-0x0000029444092000-memory.dmp
memory/5256-9479-0x0000029443F90000-0x0000029443FAC000-memory.dmp
memory/5256-9487-0x0000029444480000-0x00000294445A2000-memory.dmp
memory/5256-9486-0x0000029444230000-0x000002944424A000-memory.dmp
memory/5256-9485-0x00000294440C0000-0x00000294440DE000-memory.dmp
memory/5256-9484-0x0000029444300000-0x0000029444344000-memory.dmp
memory/5256-9483-0x0000029444270000-0x00000294442A2000-memory.dmp
memory/5256-9482-0x00000294440A0000-0x00000294440C0000-memory.dmp
memory/5256-9490-0x0000029445160000-0x00000294452E6000-memory.dmp
memory/5256-9480-0x0000029444C90000-0x000002944515C000-memory.dmp
memory/5256-9488-0x0000029444350000-0x00000294443CE000-memory.dmp
memory/5336-997-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5336-1004-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5336-1006-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5336-1003-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5336-1007-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5336-998-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5336-999-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5336-1005-0x0000016A69470000-0x0000016A69471000-memory.dmp
memory/5364-9859-0x000001C3F4B20000-0x000001C3F4B86000-memory.dmp
memory/5988-408-0x0000000000320000-0x0000000002848000-memory.dmp
memory/5988-0-0x0000000000320000-0x0000000002848000-memory.dmp
memory/5988-426-0x0000000000324000-0x0000000002058000-memory.dmp
memory/5988-427-0x0000000000320000-0x0000000002848000-memory.dmp
memory/5988-2-0x0000000000324000-0x0000000002058000-memory.dmp
memory/5988-451-0x0000000000320000-0x0000000002848000-memory.dmp
memory/5988-22-0x0000000000320000-0x0000000002848000-memory.dmp
memory/6268-9553-0x000001BDC8AA0000-0x000001BDC8AC6000-memory.dmp
memory/6880-10554-0x00000161DFC10000-0x00000161DFC32000-memory.dmp
memory/7488-9873-0x000001E592780000-0x000001E5927B2000-memory.dmp
memory/7488-9885-0x000001E5ABDB0000-0x000001E5AC179000-memory.dmp
memory/7488-9869-0x000001E5AAF70000-0x000001E5AB5EA000-memory.dmp
memory/7488-9870-0x000001E5AAAC0000-0x000001E5AAC82000-memory.dmp
memory/7488-9871-0x000001E590A00000-0x000001E590A2E000-memory.dmp
memory/7488-9876-0x000001E5AADA0000-0x000001E5AAEAA000-memory.dmp
memory/7488-9874-0x000001E5AAA50000-0x000001E5AAABE000-memory.dmp
memory/7488-9872-0x000001E5AA9A0000-0x000001E5AAA4A000-memory.dmp
memory/7488-9875-0x000001E5AB9D0000-0x000001E5ABDAA000-memory.dmp
memory/7488-9879-0x000001E5AA940000-0x000001E5AA984000-memory.dmp
memory/7488-9880-0x000001E5AA8F0000-0x000001E5AA91A000-memory.dmp
memory/7488-9881-0x000001E5AAEB0000-0x000001E5AAF3C000-memory.dmp
memory/7488-9884-0x000001E5AAD20000-0x000001E5AAD42000-memory.dmp
memory/7488-9877-0x000001E5AAC90000-0x000001E5AACF0000-memory.dmp
memory/7488-9883-0x000001E5909E0000-0x000001E5909EC000-memory.dmp
memory/7488-9882-0x000001E5AB770000-0x000001E5AB8E6000-memory.dmp
memory/7488-9878-0x000001E590A40000-0x000001E590A64000-memory.dmp
memory/7564-9867-0x0000018292EA0000-0x0000018292EBA000-memory.dmp
memory/7660-9865-0x000001E4E0FE0000-0x000001E4E1076000-memory.dmp
memory/7752-9864-0x000001A3E2100000-0x000001A3E214F000-memory.dmp
memory/7904-9863-0x000002B63BF50000-0x000002B63BF6E000-memory.dmp
memory/7916-9862-0x00000204CEAC0000-0x00000204CEB26000-memory.dmp
memory/8216-9861-0x000001D4F76C0000-0x000001D4F7A29000-memory.dmp
memory/8224-9858-0x0000019245120000-0x0000019245186000-memory.dmp
memory/8228-9860-0x0000025B9B340000-0x0000025B9B5C6000-memory.dmp
memory/8412-9855-0x00000214A4B30000-0x00000214A5158000-memory.dmp
memory/8500-9853-0x000001A71EF20000-0x000001A71F09C000-memory.dmp
memory/8692-9852-0x0000019A38BF0000-0x0000019A38F56000-memory.dmp
memory/9752-10168-0x0000015A75800000-0x0000015A7584A000-memory.dmp
memory/9752-10172-0x0000015A5D520000-0x0000015A5D547000-memory.dmp
memory/9752-10173-0x0000015A75730000-0x0000015A757F9000-memory.dmp
memory/9752-10174-0x0000015A75900000-0x0000015A759A2000-memory.dmp
memory/9752-10175-0x0000015A759B0000-0x0000015A759E1000-memory.dmp
memory/9752-10177-0x0000015A5D500000-0x0000015A5D510000-memory.dmp
memory/9752-10178-0x0000015A75850000-0x0000015A7588D000-memory.dmp
memory/9752-10182-0x0000015A5D510000-0x0000015A5D51B000-memory.dmp
memory/9752-10186-0x0000015A758E0000-0x0000015A758FA000-memory.dmp
memory/9752-10185-0x0000015A76070000-0x0000015A76210000-memory.dmp
memory/9752-10184-0x0000015A756C0000-0x0000015A756D0000-memory.dmp
memory/9752-10183-0x0000015A75E10000-0x0000015A75EC4000-memory.dmp
memory/9752-10181-0x0000015A758B0000-0x0000015A758DB000-memory.dmp
memory/9752-10180-0x0000015A75890000-0x0000015A758A2000-memory.dmp
memory/9752-10179-0x0000015A75A80000-0x0000015A75B4F000-memory.dmp
memory/9752-10176-0x0000015A756F0000-0x0000015A75713000-memory.dmp
memory/9752-10171-0x0000015A75660000-0x0000015A75683000-memory.dmp
memory/9752-10170-0x0000015A5D4F0000-0x0000015A5D4F8000-memory.dmp
memory/9752-10169-0x0000015A5CF00000-0x0000015A5CF11000-memory.dmp
memory/9752-10167-0x0000015A5CEF0000-0x0000015A5CEF8000-memory.dmp
memory/9752-10166-0x0000015A5CEE0000-0x0000015A5CEE8000-memory.dmp
memory/9752-10165-0x0000015A5CE90000-0x0000015A5CE9B000-memory.dmp
memory/10180-10149-0x0000021ABB190000-0x0000021ABB1C4000-memory.dmp