expiro | 589b43fa7238cc74c26eb8df2d5539f96f0a2ad17d564aa45b230aeea39e518d

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
Size

770KB
MD5

01dcdcc473c3c1013a10332813ae07dc
SHA1

6c0c04830c69ae0ada3776ed94dd75a4b41fe706
SHA256

589b43fa7238cc74c26eb8df2d5539f96f0a2ad17d564aa45b230aeea39e518d
SHA512

fbb7f89023c69af33ed5d68e8454475940af33b5d739ad372cb925b057b7f62f17f54070995a849c078595b02681138d43e9f31827754d16a28949ba532b1cf1
SSDEEP

24576:p4oS7oAoHL8cS7ONaG1Pf1DwnhoJaONci+NfaP2:XqDaLdqWdMhyF

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 3 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2136-2-0x0000000001000000-0x00000000011E4000-memory.dmp	family_expiro1
behavioral1/memory/2820-55-0x0000000010000000-0x00000000101BF000-memory.dmp	family_expiro1
behavioral1/memory/2180-95-0x0000000000400000-0x00000000005C8000-memory.dmp	family_expiro1

Executes dropped EXE 64 IoCs

pid	Process
2820	mscorsvw.exe
476	Process not Found
3020	mscorsvw.exe
2180	mscorsvw.exe
2504	mscorsvw.exe
2528	elevation_service.exe
2976	IEEtwCollector.exe
556	mscorsvw.exe
640	mscorsvw.exe
2568	mscorsvw.exe
1296	mscorsvw.exe
628	mscorsvw.exe
308	mscorsvw.exe
2772	mscorsvw.exe
816	mscorsvw.exe
1352	mscorsvw.exe
2128	mscorsvw.exe
2168	mscorsvw.exe
1604	mscorsvw.exe
1760	mscorsvw.exe
2420	mscorsvw.exe
1504	mscorsvw.exe
2688	mscorsvw.exe
2628	mscorsvw.exe
3028	mscorsvw.exe
2492	mscorsvw.exe
1996	mscorsvw.exe
1676	mscorsvw.exe
1948	mscorsvw.exe
2016	mscorsvw.exe
2872	mscorsvw.exe
2092	mscorsvw.exe
2676	mscorsvw.exe
1068	mscorsvw.exe
2216	mscorsvw.exe
272	mscorsvw.exe
2272	mscorsvw.exe
1604	mscorsvw.exe
2420	mscorsvw.exe
2644	mscorsvw.exe
2732	mscorsvw.exe
2792	mscorsvw.exe
2572	mscorsvw.exe
1144	mscorsvw.exe
1552	mscorsvw.exe
1256	mscorsvw.exe
1628	mscorsvw.exe
1004	mscorsvw.exe
1160	mscorsvw.exe
2280	mscorsvw.exe
1636	mscorsvw.exe
2288	mscorsvw.exe
2368	mscorsvw.exe
2496	mscorsvw.exe
2816	mscorsvw.exe
2640	mscorsvw.exe
1692	mscorsvw.exe
2796	mscorsvw.exe
2968	mscorsvw.exe
3012	mscorsvw.exe
1812	mscorsvw.exe
2664	mscorsvw.exe
1344	mscorsvw.exe
1940	mscorsvw.exe

Loads dropped DLL 52 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
2772	mscorsvw.exe
2772	mscorsvw.exe
1352	mscorsvw.exe
1352	mscorsvw.exe
2168	mscorsvw.exe
2168	mscorsvw.exe
1760	mscorsvw.exe
1760	mscorsvw.exe
1504	mscorsvw.exe
1504	mscorsvw.exe
2628	mscorsvw.exe
2628	mscorsvw.exe
2492	mscorsvw.exe
2492	mscorsvw.exe
1676	mscorsvw.exe
1676	mscorsvw.exe
2016	mscorsvw.exe
2016	mscorsvw.exe
2092	mscorsvw.exe
2092	mscorsvw.exe
1068	mscorsvw.exe
1068	mscorsvw.exe
272	mscorsvw.exe
272	mscorsvw.exe
1604	mscorsvw.exe
1604	mscorsvw.exe
2644	mscorsvw.exe
2644	mscorsvw.exe
2792	mscorsvw.exe
2792	mscorsvw.exe
1144	mscorsvw.exe
1144	mscorsvw.exe
2280	mscorsvw.exe
2280	mscorsvw.exe
1636	mscorsvw.exe
1636	mscorsvw.exe
2368	mscorsvw.exe
2368	mscorsvw.exe
892	mscorsvw.exe
892	mscorsvw.exe
3000	mscorsvw.exe
3000	mscorsvw.exe
2312	mscorsvw.exe
2312	mscorsvw.exe
928	mscorsvw.exe
928	mscorsvw.exe
1472	mscorsvw.exe
1472	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3063565911-2056067323-3330884624-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3063565911-2056067323-3330884624-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\I:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\K:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\L:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\T:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\O:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\J:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\Y:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\R:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\G:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\M:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\N:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\W:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\E:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\H:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\P:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\Q:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\S:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\U:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\X:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\V:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened (read-only)	\??\Z:	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\dllhost.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\ui0detect.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\vds.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File created	\??\c:\windows\system32\vssvc.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File created	\??\c:\windows\system32\alg.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\msdtc.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Internet Explorer\ielowutil.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\7-Zip\7zFM.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\7-Zip\7z.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPAE68.tmp\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP68F0.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPD7D8.tmp\Microsoft.Office.Tools.Common.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5ADD.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP4F97.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2136	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe
Token: SeShutdownPrivilege	2504	mscorsvw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2136	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
2136	JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 556	2504	mscorsvw.exe	36
PID 2504 wrote to memory of 556	2504	mscorsvw.exe	36
PID 2504 wrote to memory of 556	2504	mscorsvw.exe	36
PID 2504 wrote to memory of 640	2504	mscorsvw.exe	38
PID 2504 wrote to memory of 640	2504	mscorsvw.exe	38
PID 2504 wrote to memory of 640	2504	mscorsvw.exe	38
PID 2504 wrote to memory of 2568	2504	mscorsvw.exe	39
PID 2504 wrote to memory of 2568	2504	mscorsvw.exe	39
PID 2504 wrote to memory of 2568	2504	mscorsvw.exe	39
PID 2504 wrote to memory of 1296	2504	mscorsvw.exe	40
PID 2504 wrote to memory of 1296	2504	mscorsvw.exe	40
PID 2504 wrote to memory of 1296	2504	mscorsvw.exe	40
PID 2504 wrote to memory of 628	2504	mscorsvw.exe	41
PID 2504 wrote to memory of 628	2504	mscorsvw.exe	41
PID 2504 wrote to memory of 628	2504	mscorsvw.exe	41
PID 2504 wrote to memory of 308	2504	mscorsvw.exe	42
PID 2504 wrote to memory of 308	2504	mscorsvw.exe	42
PID 2504 wrote to memory of 308	2504	mscorsvw.exe	42
PID 2504 wrote to memory of 2772	2504	mscorsvw.exe	43
PID 2504 wrote to memory of 2772	2504	mscorsvw.exe	43
PID 2504 wrote to memory of 2772	2504	mscorsvw.exe	43
PID 2504 wrote to memory of 816	2504	mscorsvw.exe	44
PID 2504 wrote to memory of 816	2504	mscorsvw.exe	44
PID 2504 wrote to memory of 816	2504	mscorsvw.exe	44
PID 2504 wrote to memory of 1352	2504	mscorsvw.exe	45
PID 2504 wrote to memory of 1352	2504	mscorsvw.exe	45
PID 2504 wrote to memory of 1352	2504	mscorsvw.exe	45
PID 2504 wrote to memory of 2128	2504	mscorsvw.exe	46
PID 2504 wrote to memory of 2128	2504	mscorsvw.exe	46
PID 2504 wrote to memory of 2128	2504	mscorsvw.exe	46
PID 2504 wrote to memory of 2168	2504	mscorsvw.exe	47
PID 2504 wrote to memory of 2168	2504	mscorsvw.exe	47
PID 2504 wrote to memory of 2168	2504	mscorsvw.exe	47
PID 2504 wrote to memory of 1604	2504	mscorsvw.exe	48
PID 2504 wrote to memory of 1604	2504	mscorsvw.exe	48
PID 2504 wrote to memory of 1604	2504	mscorsvw.exe	48
PID 2504 wrote to memory of 1760	2504	mscorsvw.exe	49
PID 2504 wrote to memory of 1760	2504	mscorsvw.exe	49
PID 2504 wrote to memory of 1760	2504	mscorsvw.exe	49
PID 2504 wrote to memory of 2420	2504	mscorsvw.exe	50
PID 2504 wrote to memory of 2420	2504	mscorsvw.exe	50
PID 2504 wrote to memory of 2420	2504	mscorsvw.exe	50
PID 2504 wrote to memory of 1504	2504	mscorsvw.exe	51
PID 2504 wrote to memory of 1504	2504	mscorsvw.exe	51
PID 2504 wrote to memory of 1504	2504	mscorsvw.exe	51
PID 2504 wrote to memory of 2688	2504	mscorsvw.exe	52
PID 2504 wrote to memory of 2688	2504	mscorsvw.exe	52
PID 2504 wrote to memory of 2688	2504	mscorsvw.exe	52
PID 2504 wrote to memory of 2628	2504	mscorsvw.exe	53
PID 2504 wrote to memory of 2628	2504	mscorsvw.exe	53
PID 2504 wrote to memory of 2628	2504	mscorsvw.exe	53
PID 2504 wrote to memory of 3028	2504	mscorsvw.exe	54
PID 2504 wrote to memory of 3028	2504	mscorsvw.exe	54
PID 2504 wrote to memory of 3028	2504	mscorsvw.exe	54
PID 2504 wrote to memory of 2492	2504	mscorsvw.exe	55
PID 2504 wrote to memory of 2492	2504	mscorsvw.exe	55
PID 2504 wrote to memory of 2492	2504	mscorsvw.exe	55
PID 2504 wrote to memory of 1996	2504	mscorsvw.exe	56
PID 2504 wrote to memory of 1996	2504	mscorsvw.exe	56
PID 2504 wrote to memory of 1996	2504	mscorsvw.exe	56
PID 2504 wrote to memory of 1676	2504	mscorsvw.exe	57
PID 2504 wrote to memory of 1676	2504	mscorsvw.exe	57
PID 2504 wrote to memory of 1676	2504	mscorsvw.exe	57
PID 2504 wrote to memory of 1948	2504	mscorsvw.exe	58

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01dcdcc473c3c1013a10332813ae07dc.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2136

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2820

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2180

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a4 -InterruptEvent 194 -NGENProcess 190 -Pipe 1a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 19c -InterruptEvent 23c -NGENProcess 244 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 200 -NGENProcess 1e4 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 254 -NGENProcess 234 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 190 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 1e4 -Pipe 1a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 234 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1e4 -NGENProcess 234 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 26c -NGENProcess 264 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 264 -NGENProcess 260 -Pipe 15c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 274 -NGENProcess 234 -Pipe 190 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 26c -NGENProcess 234 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 260 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 260 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 284 -NGENProcess 234 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 234 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 28c -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 258 -NGENProcess 27c -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 234 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 258 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2ac -NGENProcess 28c -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 28c -NGENProcess 29c -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2b4 -NGENProcess 258 -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 258 -NGENProcess 2ac -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2bc -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 29c -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d4 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2d4 -NGENProcess 2e8 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e8 -NGENProcess 2fc -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 30c -NGENProcess 2f4 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2f4 -NGENProcess 2d4 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 314 -NGENProcess 2fc -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 304 -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2e8 -NGENProcess 2fc -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 31c -NGENProcess 2f4 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2fc -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2f4 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2fc -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2f4 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 30c -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:1524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2fc -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:2764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2f4 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2fc -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:2672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2f4 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:1144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2fc -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2f4 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:2256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 2fc -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 2f4 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:1572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 30c -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 30c -NGENProcess 360 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 370 -NGENProcess 2f4 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 36c -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 360 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 2f4 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 36c -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 360 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 2f4 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 380 -NGENProcess 38c -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:1504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 378 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:1544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 360 -NGENProcess 388 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 390 -NGENProcess 204 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 2f4 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:2344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 388 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 204 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 2f4 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:2616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 388 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 204 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:1344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 2f4 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 388 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 204 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:2764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 2f4 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 388 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 204 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:2672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 2f4 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 388 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3b4 -NGENProcess 204 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3d0 -NGENProcess 2f4 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 388 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 204 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 2f4 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:3000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 2f4 -NGENProcess 3d4 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 3e4 -NGENProcess 204 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3d4 -NGENProcess 204 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3f0 -NGENProcess 3c8 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3c8 -NGENProcess 3e8 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3f8 -NGENProcess 204 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 3f4 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3f4 -NGENProcess 3c8 -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:1076

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

Filesize
700KB

MD5
35a8d3ce60b2ec68a71ef68a20332275

SHA1
355dffd4640a42e71528d9d2e2c132db9252198c

SHA256
7cf53f4a614aecd548dbb5dadc5362107d26de227b9b9f8bf1b9597b73527d04

SHA512
e391ec8cc9536c5af0aa8f7a792707513dfddcc3bbd9bc375998561c28e15b01339581a934dfdd8f7ad443fce134be9afd6ccc73a6242b1f97711e75181ff079

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.6MB

MD5
837be2b3db03f4309884d8c1d5893edb

SHA1
bed5da2aee0cda114d754ef616d1e1fa878bacef

SHA256
abbc70d68796fff0be77d6683409d51fc6e8e28ec84a1fbfa2657824091ac201

SHA512
f162f9c7d9a3d2049ecb796dc1d9a3ad07d272eceba5e38ec2730c48816ccc000adfc68e6762a5a1426e983dfc5cb9bbbb9143cbe346877f27981f58d7c38282

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
64e86d747ce850669ef68ec11057c916

SHA1
bd639fabec5a9642024d732e5d378377f44c656c

SHA256
93ae8650d29e3b7027d79b2caa8940cc3c86ce77c30e11422cabef7fea4a5f88

SHA512
3ab392fb014df90befeebc88a4f868c9ff7da2b08dea8af90a6bbaeae18838ed442af17b0783311a12668d8040dfec9a8f2fda71d8e91835ff032e0dc17b799e

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
506965cfe160b9cdbfb9da413e2d90c8

SHA1
dd85406f9b6ecc139880f1ff8bf2c2604a0611c2

SHA256
243f30fa5c441418dc615d5508b0bbaacdc457424483fa9645dcd88bed09e2f0

SHA512
9988ceb66865bc56dd8f32de29ba20153acf9d9191b0eea72a1e818c73ab5464ff47429908d5e8034faae9678c2f61d6a255b8bc00cf5d71e675de7754d0cb62

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
3037d850d289aa2e5b1b3f0205b78c0f

SHA1
8991814f40d7477a118b572851d81f43f9347a3f

SHA256
c8d718b539c0c223a92a10f7341d38188876e72a9b40b9e80e050a4bd0a0ef7a

SHA512
65646c279e7efb99bb6de99fc6faac03da8ec7866c6ce809aca40d5e9c1237ae59f638994f1bd05d43a905e97ad8045505cf8f0370cf77d667d42790c98b08a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
ad7a2597ee8090a8a8fee1957e27b3dc

SHA1
0fa482a463b3a1712cdbf451f228e0994368db1e

SHA256
e9460829bf22cb3065bea2f3c63eac4f2a8799f1346fcd17159eb3b210015978

SHA512
21d977e194b50cd8d83e0564d5e0bb4a78a0e1e79f1459cbd32c99221074210d8e35a7ca039dcec45031f8933fe782bea8added30618842594bff57955780d86

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
619KB

MD5
8bcc02fbe2a8d54d71e46e0cfdf8df28

SHA1
719e778f5ed579f20f5f1ea1cdfc8c26b9ba66eb

SHA256
e97bc4dd0b9357266cda2283b176bd61a004d3c54e3b5a747f9ead6a980f0aa3

SHA512
f92ec69001ffb5291ea6700825dd40ad9c9798af9a01cac90edca1ebdf47799b85e054500ab6abd095d34beceff4d60ccd78b8818e1eec57de0a7fece71f88c0

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
0a29636baa13574f3d954c0277baf6f7

SHA1
965faae013f64e3ffbf118611f37d517d8843289

SHA256
a4e897f8f40c903d12f52f1810c5f1f1c44ec89fc7df16e7ffde9714eb7f52a6

SHA512
4dbc0a97eec5a2b8834486e0996b917c3318498fb2e905a8df31ddd879efd506f2482b235d832dc2d650e03b5c652e254a3e873fba2a9a81b30bdf8622356a7f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
650KB

MD5
4c69048fd549e3a2da94d00cbf9c8375

SHA1
acfb1d4f3410500d968ed8a4d95d9e8f209538a2

SHA256
14dcf64f54b69812ebb6cae0003241ad4920f585468cf9e900dfb9bfedd4bb3a

SHA512
d7db50db9415d2f9f3f0a99dcd09a554f13ee4917b6691bfcee9d099b831ba0443a04427dc6b61d40f3ebdcfba3188a97eb517a97a14faecebad462489350c3d

Download Submit
C:\Windows\Temp\CabD6B0.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarD857.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\22b01e65c8987f8b3c7fe850bc4d2b70\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
07bc6d0a1ee5a272c4afd7e288a3aa8f

SHA1
918f28078207ddf75db5f22ae4d80e7cf300bfc2

SHA256
f3f961488be695a43e6a65cb68d26abd41fded4b4eae9038974dc2d8e6c923d8

SHA512
e9ba1d8cdc72234ce6a822ffed04b849fd05757227954a4728667e7af9d2108e046cb86ae71843e9152b33e110d1c7396c29eca3646f7cab8a7ed240b140fa48

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4f4b9bc18a12b3a3be210671081b2079\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
78b16a1aa58ecbfe970c790cf7edd3ae

SHA1
b50864451369d9dfb853b71181c7a40e891d2e3d

SHA256
4bdecc09a906dd6019284f9d00a363136a36e89dd449eb352d13a274efd12fac

SHA512
eec1f57f5f68fa0bcc0dac75730944fddc3a10c621a82290252049cae346def52b229cb4e868fc6dce491b7aa7ab06cb49a26f4afe8a2a6246201a66466441b0

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\7e576a5bfa87897b7c3c3f060eba3607\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
4b2df53bf1c0089d3df61c03bf2d85ca

SHA1
4cb998b8325c3079fa712814a9f0681641158796

SHA256
df997d1439b31c3eb9ad292c99f95f907224a60ed51c42f3783ce9639e8bd47a

SHA512
19ae89cfac9d07585bbc53605997efe44698e1b3dc69530524c3985acef9965a41b13cfe251b5018db5a4e90f2bd8eaabab001896956dcb8490052c8d5af1b00

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ee785f2b657e7626b1cf72409e56e7d8\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
342d3277c51153c31a8322791ed71158

SHA1
631e07b4e7678ab049ccccf00c50236f032242ee

SHA256
25405fd8207b22f578ecd4fc1e4708bc104c10816228a101456e6f4101db7781

SHA512
60cef76b33b9859b02402d42a0afa051c827ab534773b5ea7d4cbbe5959160ec80654e149cd1bc7f80d0bf5c7794f9a88cf6954425030a9ed576370a72cb20b2

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
700KB

MD5
1917992edc68690f995dc6d8b9a0afe4

SHA1
c8a262fbd27be9c3921d0e6122c994423e53b2db

SHA256
1da0f7624d8e93af4aed418562a79d58fd3df1265ad2f5b89acca6e8f8b511dd

SHA512
48854bb9b0d693d723e4d569565b8d616e18de58f3748bef11c547005ee88ba3f1e43a113c8030d54f42c07565376798bcbbbadfc57cd4fd7082e6f315bdd9cf

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
194f2a384e6844cb7db86ebea2178a52

SHA1
2751f2619c3f1a863ff9fb4c0c964d9da25ce1a4

SHA256
32a142f2f07a0404b3974d181fa95457103cebc30cc1cf81bb3c4d74bb8ff591

SHA512
d28f629b4666ca6a73954d88f6d2725b4f2d5ede84a96592a2db72b44d63cac21bfceb1ef7a000cfa9d1aeff4ccda15ef444d591e77d9ba8dcd5f4671c421a6c

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
775KB

MD5
ef5cfd1629978e60e3b6fa1f8ddbdaa2

SHA1
f44586e0c0f83b93b54359fe032d66601caeac74

SHA256
bee003a3add0e4288658717597c65682042b2050ae52aad89824118705934818

SHA512
776866bdcf6d13ee96dfa9236e3af4df21f6bf15ce2022061f8cc50930da31d65656a97bf21615cfa9b8e57804bf3f368c2f0beb10980ae47371114ee298e747

Download Submit
\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe

Filesize
5.2MB

MD5
27da6fb97b903766a894d9536d32bc5a

SHA1
9870fd191df30601a6005da76ff300aa002fa29d

SHA256
cfe50148d31ce7e7447da9c63ded39f56a83e30a3c2d6456808b0c1be402d6b6

SHA512
2ad69fbac778791a39b054ff395673b0e89ffc151fb17c34b37225c01be8aab5981afb2cef6407f9e72737150db3857f46719cf79956ecf6ec42ecbe2a1df79b

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
684KB

MD5
3efd34f146e46cd26ecedab31f21b878

SHA1
2241a76b52b72bd2988dd287db3ceb184f58d4d5

SHA256
fee26301b5f99b172c4708e954b6d0d1286d255daf16b64df4e38dd96261689c

SHA512
e6f37a60f4c5aceca929878de1ed542d66801a806b7c1a55fe188754ca6b21bcb5f5ec85b29ec5191002705c457e10b1941d37a88ea3b020c86c1f1f974b6c2f

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
596KB

MD5
393e1b0c36cc1f75b3b48391246bd93d

SHA1
a80007160ccfe17e25756785584dd0268f4cb7d8

SHA256
6f3812d0127fcc02bab8b57b3756dd78107570831c7d45d49046c4426d88d018

SHA512
8ab3aefd15d6f39d800914ac48300e161c82a27f53e41cfd782a5ec52e5bdaa2726124500dc8989ddd4380534f9c303c5689ff0c4eb9dd93ac645aacfd9ae7f4

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
637KB

MD5
acb43de0ef7e612bab97b0b3bae54ce1

SHA1
d3825ab8ab621f31a46d314f598ed6fdf2f10f6a

SHA256
44a49a16521de45e9f10c170090973986397b442ea7c64ed2604e5ef023debd7

SHA512
cb52b33eb649de5e6ca866ba1b68ddaebc97e303c83630a5091ada04df23bbcfd6226129cb2be3e3ffdbecad447fbfca8b87db6241e0fe97c091ad6a5c505bf0

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
ad8a8ce3cb213418f24791c842559bb8

SHA1
9c638aa6e334e14038a00c425a17f1c6e223fce1

SHA256
671f2afeea925f24b793f35d931487bf357361d8f14bf53cbd8d1878da7e3034

SHA512
10b4851fee53f2b114a14836976a23b6aad858e963dbd92e9f73141a64f4e0dc28334260d535505018ed459bb416fc9445dbfd5d34e4b56dd51657aa2ebde7f3

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
698KB

MD5
8b51a67e91fc1d8e859f59344f91186c

SHA1
15c2f4b773ce4e5e76a8322200d29e320cb79a17

SHA256
45574f8ae22108f5dc25c7bc0e3d8a244bb6048c94b7461d20dad8d8bcc30535

SHA512
b382962dc1db176953dcde5f9e97bd8093837a1eaec94dcaaaa7688c6cec5873f5eb457e1cf1161b2059b447956ef04fb49dcc6a8237e98cc3a2d8d1a695fc3e

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
685KB

MD5
5c991e554a4e0a3d3d024f541719337b

SHA1
e04072bec5b5c79a21c00a84d9cb02594827ff02

SHA256
6d110fdf2d0d07aaba251b81ac4d460933eb2164fc4b2476cb263ba8bb5d21e9

SHA512
a45fbbb74b93283e57486326937cd95c3f31f319e5f790d5abfa69f4c0e86cd920c812066be90de39fd57fa0b80a0c4cc7aff8fcdb926a8dd6154df41f081f0d

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
574KB

MD5
0dfaa7f56a85db006fdc0e1e9c9b284c

SHA1
939386cfcfe5db90fe66ee3ab9d3e2880a3673c2

SHA256
d239da59f0f8c9d72a0aff1b8c3d685126e05c8e6643accbcad3687c76656171

SHA512
d669faddc73d841c2aa73b77785a65ea6f2cf4f2feea0d5a8ee262a4d5bf4ae8053b3f47d085a7ec1410356d427d51112c3c1ac4a5a7f5c1ae558e7b58c0fbc7

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
600KB

MD5
9ca0c5172eed449271db79f0f01c196b

SHA1
102033fd7e9264b27ac0a544952d1f9b1afdbdfc

SHA256
b32e7a1042b9c7bed0be88e0d3f84fc8af68100ebbe30b26e303803c5f1a9de0

SHA512
a3eb265d98ab9f800cd594650abbc5b242037da15508874238537c3ae4011aad0459bb2ae2efd4ff0c07278badb29f7b6ac85f94de5dd71195ab64fcbe4446dd

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.1MB

MD5
e0a34718425ba55e9549199ed45762ce

SHA1
590abf8312012df62879e7c0d7f57022005b09a3

SHA256
b3b370efcf6bef8df6f48964c5bde81fb14e965471a1a078cbcd0608e8314709

SHA512
136de3b046585677031d7d1e1f364f4fc873a2a3d28db74c55345e1107d79882bac8e1ff05fad893d5d454556720119577f20b5fae1f0a10e7838c32e93c23b1

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.1MB

MD5
7d46e46f452382bb3e4ce51f589c59d6

SHA1
0342d5bbd72c55766a96870298b5a180cfee5218

SHA256
3aeb14dbfbe970a31e970c150e6d8d9724f386f5179e30cf7c50c02c799b19c6

SHA512
752749a1593698bae52743fc04facf04d49e293bb28b4a52dc6b15534f2aa8a6c370143652d52e5958d3d807e9428ed4f8d4deced79c6ea9ac8186e06d43c804

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
758KB

MD5
ee009136e0ef52e4a0190cf6bc69e7f5

SHA1
d4f5ee26db2e4e839173effe12006d353246c8be

SHA256
d86db8571d10015c5219625ed171d3dabd154a4b2b179f6a7a44b210ec192e6f

SHA512
580f083dacf6d6981d5ba2722b58239381c89b86b52f29653d6bc3227a5dcbbdc735ea2141f9a41a9f52343ba9c7656ee263a8e9c6cd4ac48ebddb881cdf0131

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.0MB

MD5
13f397691817247c2e2e21c33033b284

SHA1
5cf5638cb60a404c92567f6ed9287387c2264848

SHA256
92e75cd304db6c3ad6bab9103c7fad7a62cb4a8f6fe10001a07d50dfc7d50fb2

SHA512
78826c6bfc3c6d5739073a9f7814a61887a66985e9f3e485c6bea8fe03cca4d3b64ad4f947cfa6acf37de36d90ae2d89a812decba9b14393104b43a83b5d1423

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
cd6e4eea4fd89f0c663afad4a29fc6b1

SHA1
2862aaa085f499b4291855049574c8d1a70f0b71

SHA256
728427fad76cfa545b3fbdbf8df59569d8753aecac758d7970ef2352fb9d370f

SHA512
ce97f12fc55cc89b0f6bdfba6ad90fd5b6c22701809403c22707697b5d3ea934181e2c4f663c57fc4a47a7b9dad29d16f5690bb829b709a90a17ed8b10a6326d

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
642KB

MD5
083f32efa4c910a853a12d015d3eb622

SHA1
1797ac0e60a1961b0586ff018a2100c97c0aabd1

SHA256
585042b55a5ee36e1e592acf6a00eb6e8447da19bd75324c1b7689f7c906c3ec

SHA512
1820cefa1307b1b0e1b1048207de021f28b6a23bd4657238be2f7d327f27b9257781df66b43e633fbdc6d0d6ef55c1b23bb8e4566aec55a4daa222f78900abaf

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
670KB

MD5
c7e50827549c27b624a9257a246398d9

SHA1
75413fe17729f1df15b110cd031ba3469d8e817d

SHA256
acda99d73fb4c5dbb5c72fb41f9943085fe0e5c061270034c393eb85dbc98349

SHA512
67d5408f130209c5db2a2c2a2e063a98ee11ca6f3ebb34d85953c5711042a3077fea87fc426177dca6caa57a5a1379524735273eabb34799a6dfd24b44040d88

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
669KB

MD5
44727cb4177144df939ee66f509f1a72

SHA1
da184297aef43a9d259ca9abca3ad99860136ab8

SHA256
92fc2471031a42e67a162fb280b16c627e0070137f4e8612b93ae1e5d3c2e218

SHA512
b2e0d30409ad062542a97ca10307ff841a6f459bff136516eb519dd2f6bb0c9d983906f4b8df1cd41458a4c13118f29625bd001265cf7a9a48f02927b3cb7e90

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP4F97.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP531F.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5754.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5ADD.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5DF8.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6114.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
memory/308-309-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/308-310-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/308-311-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/308-312-0x000000001C4B0000-0x000000001C4F8000-memory.dmp

Filesize
288KB

Download
memory/308-313-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/308-315-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/556-182-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/556-170-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/628-308-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/640-183-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/640-181-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/816-342-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/816-340-0x0000000003010000-0x000000000302E000-memory.dmp

Filesize
120KB

Download
memory/816-335-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/816-336-0x0000000002F40000-0x0000000002F58000-memory.dmp

Filesize
96KB

Download
memory/816-338-0x0000000002F90000-0x0000000002F9E000-memory.dmp

Filesize
56KB

Download
memory/816-339-0x0000000002FF0000-0x000000000300A000-memory.dmp

Filesize
104KB

Download
memory/1296-306-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/1352-344-0x0000000003040000-0x0000000003058000-memory.dmp

Filesize
96KB

Download
memory/1352-367-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/1352-357-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/1352-345-0x000000001C480000-0x000000001C48C000-memory.dmp

Filesize
48KB

Download
memory/1352-346-0x000000001C490000-0x000000001C49E000-memory.dmp

Filesize
56KB

Download
memory/1352-347-0x000000001C4A0000-0x000000001C4B6000-memory.dmp

Filesize
88KB

Download
memory/1352-348-0x000000001C4C0000-0x000000001C508000-memory.dmp

Filesize
288KB

Download
memory/1352-349-0x000000001C510000-0x000000001C52A000-memory.dmp

Filesize
104KB

Download
memory/1352-350-0x000000001CA00000-0x000000001CA1E000-memory.dmp

Filesize
120KB

Download
memory/1352-358-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/1504-427-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/1504-436-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/1504-422-0x00000000007F0000-0x0000000000806000-memory.dmp

Filesize
88KB

Download
memory/1504-421-0x00000000007D0000-0x00000000007EA000-memory.dmp

Filesize
104KB

Download
memory/1504-426-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/1604-397-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/1604-393-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/1604-394-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/1604-395-0x0000000003050000-0x0000000003064000-memory.dmp

Filesize
80KB

Download
memory/1760-406-0x0000000003100000-0x000000000310C000-memory.dmp

Filesize
48KB

Download
memory/1760-400-0x0000000000830000-0x000000000083C000-memory.dmp

Filesize
48KB

Download
memory/1760-399-0x0000000000390000-0x000000000039C000-memory.dmp

Filesize
48KB

Download
memory/1760-401-0x0000000003060000-0x0000000003074000-memory.dmp

Filesize
80KB

Download
memory/1760-405-0x0000000003100000-0x000000000310C000-memory.dmp

Filesize
48KB

Download
memory/1760-415-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2128-368-0x0000000000790000-0x000000000079C000-memory.dmp

Filesize
48KB

Download
memory/2128-370-0x00000000008C0000-0x00000000008D0000-memory.dmp

Filesize
64KB

Download
memory/2128-372-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2136-1-0x000000000101A000-0x000000000101B000-memory.dmp

Filesize
4KB

Download
memory/2136-2-0x0000000001000000-0x00000000011E4000-memory.dmp

Filesize
1.9MB

Download
memory/2136-0-0x0000000001000000-0x00000000011E4000-memory.dmp

Filesize
1.9MB

Download
memory/2168-379-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download
memory/2168-377-0x0000000000870000-0x0000000000886000-memory.dmp

Filesize
88KB

Download
memory/2168-376-0x0000000000640000-0x000000000064E000-memory.dmp

Filesize
56KB

Download
memory/2168-378-0x00000000008E0000-0x00000000008FA000-memory.dmp

Filesize
104KB

Download
memory/2168-375-0x0000000000630000-0x000000000063C000-memory.dmp

Filesize
48KB

Download
memory/2168-374-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/2168-384-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/2168-383-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/2168-392-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2180-46-0x0000000000400000-0x00000000005C8000-memory.dmp

Filesize
1.8MB

Download
memory/2180-95-0x0000000000400000-0x00000000005C8000-memory.dmp

Filesize
1.8MB

Download
memory/2180-47-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/2420-419-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2420-417-0x0000000000760000-0x0000000000776000-memory.dmp

Filesize
88KB

Download
memory/2420-416-0x0000000000740000-0x000000000075A000-memory.dmp

Filesize
104KB

Download
memory/2492-456-0x0000000003060000-0x0000000003076000-memory.dmp

Filesize
88KB

Download
memory/2492-459-0x000000001C520000-0x000000001C536000-memory.dmp

Filesize
88KB

Download
memory/2492-458-0x000000001C520000-0x000000001C536000-memory.dmp

Filesize
88KB

Download
memory/2504-61-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2504-62-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download
memory/2504-146-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2528-87-0x0000000140000000-0x0000000140382000-memory.dmp

Filesize
3.5MB

Download
memory/2568-304-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2568-302-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2628-452-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2628-444-0x0000000000760000-0x000000000076E000-memory.dmp

Filesize
56KB

Download
memory/2628-441-0x00000000006B0000-0x00000000006BE000-memory.dmp

Filesize
56KB

Download
memory/2688-439-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2688-437-0x00000000006B0000-0x00000000006BE000-memory.dmp

Filesize
56KB

Download
memory/2772-334-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2772-318-0x0000000000700000-0x000000000070C000-memory.dmp

Filesize
48KB

Download
memory/2772-317-0x00000000006B0000-0x00000000006BE000-memory.dmp

Filesize
56KB

Download
memory/2772-325-0x0000000003180000-0x000000000318E000-memory.dmp

Filesize
56KB

Download
memory/2772-319-0x0000000000710000-0x0000000000758000-memory.dmp

Filesize
288KB

Download
memory/2772-320-0x00000000030E0000-0x00000000030F6000-memory.dmp

Filesize
88KB

Download
memory/2772-324-0x0000000003180000-0x000000000318E000-memory.dmp

Filesize
56KB

Download
memory/2820-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2820-55-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/2820-21-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/2976-94-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2976-179-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2976-221-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/3020-35-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/3020-37-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/3020-72-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/3028-454-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/3028-453-0x0000000000840000-0x0000000000856000-memory.dmp

Filesize
88KB

Download