expiro | 52c44545129a7efe21cc8a3b71a4166af528a5b5142425617dcc907f62471478

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/12/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
Size

645KB
MD5

09d607bb679423c3a1636d922b0470a8
SHA1

29895b10fbb22ea67adc7c05f9bde69dc79d8f68
SHA256

52c44545129a7efe21cc8a3b71a4166af528a5b5142425617dcc907f62471478
SHA512

90413037654dec1ecdd469cdc8a863ae82ac586a30f9e683aa1b9e3f8a54bc494fb99860f4fd4af4e5bc1da6974501af5a3c91e063fb762528f2f559a23ce0b6
SSDEEP

12288:rYG8GLVeUF+bZnoD2kUQf3zyJQ/aEy+W27jIhyeNnCZ:0G8GLwA+bZWXUQfDyqCINghygnCZ

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 3 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2444-2-0x0000000000400000-0x00000000005CF000-memory.dmp	family_expiro1
behavioral1/memory/2644-62-0x0000000010000000-0x00000000101B7000-memory.dmp	family_expiro1
behavioral1/memory/1460-152-0x0000000140000000-0x0000000140371000-memory.dmp	family_expiro1

Executes dropped EXE 64 IoCs

pid	Process
2644	mscorsvw.exe
480	Process not Found
2756	mscorsvw.exe
2980	mscorsvw.exe
2688	mscorsvw.exe
1460	elevation_service.exe
1448	IEEtwCollector.exe
1604	mscorsvw.exe
2032	mscorsvw.exe
1728	mscorsvw.exe
1612	mscorsvw.exe
2096	mscorsvw.exe
2168	mscorsvw.exe
2404	mscorsvw.exe
1928	mscorsvw.exe
2000	mscorsvw.exe
1968	mscorsvw.exe
1740	mscorsvw.exe
2300	mscorsvw.exe
2284	mscorsvw.exe
2112	mscorsvw.exe
2264	mscorsvw.exe
2800	mscorsvw.exe
2664	mscorsvw.exe
388	mscorsvw.exe
1892	mscorsvw.exe
2288	mscorsvw.exe
628	mscorsvw.exe
2192	mscorsvw.exe
2072	mscorsvw.exe
2136	mscorsvw.exe
1632	mscorsvw.exe
2008	mscorsvw.exe
2448	mscorsvw.exe
1968	mscorsvw.exe
2064	mscorsvw.exe
2200	mscorsvw.exe
1884	mscorsvw.exe
1736	mscorsvw.exe
2596	mscorsvw.exe
3008	mscorsvw.exe
788	mscorsvw.exe
2884	mscorsvw.exe
2288	mscorsvw.exe
1316	mscorsvw.exe
900	mscorsvw.exe
1912	mscorsvw.exe
1428	mscorsvw.exe
320	mscorsvw.exe
1740	mscorsvw.exe
2524	mscorsvw.exe
2760	mscorsvw.exe
2824	mscorsvw.exe
1844	mscorsvw.exe
2944	mscorsvw.exe
3004	mscorsvw.exe
1556	mscorsvw.exe
2596	mscorsvw.exe
1192	mscorsvw.exe
2296	mscorsvw.exe
1852	mscorsvw.exe
1684	mscorsvw.exe
1728	mscorsvw.exe
2916	mscorsvw.exe

Loads dropped DLL 64 IoCs

pid	Process
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
2404	mscorsvw.exe
2404	mscorsvw.exe
2000	mscorsvw.exe
2000	mscorsvw.exe
1740	mscorsvw.exe
1740	mscorsvw.exe
2284	mscorsvw.exe
2284	mscorsvw.exe
2264	mscorsvw.exe
2264	mscorsvw.exe
2664	mscorsvw.exe
2664	mscorsvw.exe
1892	mscorsvw.exe
1892	mscorsvw.exe
628	mscorsvw.exe
628	mscorsvw.exe
2072	mscorsvw.exe
2072	mscorsvw.exe
1632	mscorsvw.exe
1632	mscorsvw.exe
2448	mscorsvw.exe
2448	mscorsvw.exe
2064	mscorsvw.exe
2064	mscorsvw.exe
1884	mscorsvw.exe
1884	mscorsvw.exe
2596	mscorsvw.exe
2596	mscorsvw.exe
788	mscorsvw.exe
788	mscorsvw.exe
2288	mscorsvw.exe
2288	mscorsvw.exe
1740	mscorsvw.exe
1740	mscorsvw.exe
2524	mscorsvw.exe
2524	mscorsvw.exe
2824	mscorsvw.exe
2824	mscorsvw.exe
1012	mscorsvw.exe
1012	mscorsvw.exe
1640	mscorsvw.exe
1640	mscorsvw.exe
1372	mscorsvw.exe
1372	mscorsvw.exe
2560	mscorsvw.exe
2560	mscorsvw.exe
1208	mscorsvw.exe
1208	mscorsvw.exe
276	mscorsvw.exe
276	mscorsvw.exe
3004	mscorsvw.exe
3004	mscorsvw.exe
1192	mscorsvw.exe
1192	mscorsvw.exe
2976	mscorsvw.exe
2976	mscorsvw.exe
2304	mscorsvw.exe
2304	mscorsvw.exe
1700	mscorsvw.exe
1700	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-312935884-697965778-3955649944-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-312935884-697965778-3955649944-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\N:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\T:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\V:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\Y:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\H:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\R:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\E:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\J:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\L:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\X:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\O:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\P:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\S:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\U:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\I:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\G:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\W:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\Z:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\K:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\Q:	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened (read-only)	\??\N:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\vds.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\ui0detect.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File created	\??\c:\windows\system32\alg.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\vssvc.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\windows\system32\msdtc.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Internet Explorer\ielowutil.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\7-Zip\7zG.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\DVD Maker\DVDMaker.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Program Files\7-Zip\7z.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	\??\c:\windows\ehome\ehsched.vir	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPEADC.tmp\Microsoft.Office.Tools.Excel.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index160.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15e.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8A26.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15f.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index161.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index160.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15f.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15d.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9415.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "mscorsvw.exe"	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe
2688	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2444	JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe
Token: SeShutdownPrivilege	2688	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1604	2688	mscorsvw.exe	37
PID 2688 wrote to memory of 1604	2688	mscorsvw.exe	37
PID 2688 wrote to memory of 1604	2688	mscorsvw.exe	37
PID 2688 wrote to memory of 2032	2688	mscorsvw.exe	39
PID 2688 wrote to memory of 2032	2688	mscorsvw.exe	39
PID 2688 wrote to memory of 2032	2688	mscorsvw.exe	39
PID 2688 wrote to memory of 1728	2688	mscorsvw.exe	40
PID 2688 wrote to memory of 1728	2688	mscorsvw.exe	40
PID 2688 wrote to memory of 1728	2688	mscorsvw.exe	40
PID 2688 wrote to memory of 1612	2688	mscorsvw.exe	41
PID 2688 wrote to memory of 1612	2688	mscorsvw.exe	41
PID 2688 wrote to memory of 1612	2688	mscorsvw.exe	41
PID 2688 wrote to memory of 2096	2688	mscorsvw.exe	42
PID 2688 wrote to memory of 2096	2688	mscorsvw.exe	42
PID 2688 wrote to memory of 2096	2688	mscorsvw.exe	42
PID 2688 wrote to memory of 2168	2688	mscorsvw.exe	43
PID 2688 wrote to memory of 2168	2688	mscorsvw.exe	43
PID 2688 wrote to memory of 2168	2688	mscorsvw.exe	43
PID 2688 wrote to memory of 2404	2688	mscorsvw.exe	44
PID 2688 wrote to memory of 2404	2688	mscorsvw.exe	44
PID 2688 wrote to memory of 2404	2688	mscorsvw.exe	44
PID 2688 wrote to memory of 1928	2688	mscorsvw.exe	45
PID 2688 wrote to memory of 1928	2688	mscorsvw.exe	45
PID 2688 wrote to memory of 1928	2688	mscorsvw.exe	45
PID 2688 wrote to memory of 2000	2688	mscorsvw.exe	46
PID 2688 wrote to memory of 2000	2688	mscorsvw.exe	46
PID 2688 wrote to memory of 2000	2688	mscorsvw.exe	46
PID 2688 wrote to memory of 1968	2688	mscorsvw.exe	47
PID 2688 wrote to memory of 1968	2688	mscorsvw.exe	47
PID 2688 wrote to memory of 1968	2688	mscorsvw.exe	47
PID 2688 wrote to memory of 1740	2688	mscorsvw.exe	48
PID 2688 wrote to memory of 1740	2688	mscorsvw.exe	48
PID 2688 wrote to memory of 1740	2688	mscorsvw.exe	48
PID 2688 wrote to memory of 2300	2688	mscorsvw.exe	50
PID 2688 wrote to memory of 2300	2688	mscorsvw.exe	50
PID 2688 wrote to memory of 2300	2688	mscorsvw.exe	50
PID 2688 wrote to memory of 2284	2688	mscorsvw.exe	51
PID 2688 wrote to memory of 2284	2688	mscorsvw.exe	51
PID 2688 wrote to memory of 2284	2688	mscorsvw.exe	51
PID 2688 wrote to memory of 2112	2688	mscorsvw.exe	52
PID 2688 wrote to memory of 2112	2688	mscorsvw.exe	52
PID 2688 wrote to memory of 2112	2688	mscorsvw.exe	52
PID 2688 wrote to memory of 2264	2688	mscorsvw.exe	53
PID 2688 wrote to memory of 2264	2688	mscorsvw.exe	53
PID 2688 wrote to memory of 2264	2688	mscorsvw.exe	53
PID 2688 wrote to memory of 2800	2688	mscorsvw.exe	54
PID 2688 wrote to memory of 2800	2688	mscorsvw.exe	54
PID 2688 wrote to memory of 2800	2688	mscorsvw.exe	54
PID 2688 wrote to memory of 2664	2688	mscorsvw.exe	55
PID 2688 wrote to memory of 2664	2688	mscorsvw.exe	55
PID 2688 wrote to memory of 2664	2688	mscorsvw.exe	55
PID 2688 wrote to memory of 388	2688	mscorsvw.exe	56
PID 2688 wrote to memory of 388	2688	mscorsvw.exe	56
PID 2688 wrote to memory of 388	2688	mscorsvw.exe	56
PID 2688 wrote to memory of 1892	2688	mscorsvw.exe	57
PID 2688 wrote to memory of 1892	2688	mscorsvw.exe	57
PID 2688 wrote to memory of 1892	2688	mscorsvw.exe	57
PID 2688 wrote to memory of 2288	2688	mscorsvw.exe	58
PID 2688 wrote to memory of 2288	2688	mscorsvw.exe	58
PID 2688 wrote to memory of 2288	2688	mscorsvw.exe	58
PID 2688 wrote to memory of 628	2688	mscorsvw.exe	59
PID 2688 wrote to memory of 628	2688	mscorsvw.exe	59
PID 2688 wrote to memory of 628	2688	mscorsvw.exe	59
PID 2688 wrote to memory of 2192	2688	mscorsvw.exe	60

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2644

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2980

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 238 -NGENProcess 244 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 1e4 -NGENProcess 150 -Pipe 184 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 268 -NGENProcess 1e8 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 150 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 1e8 -Pipe 15c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 150 -NGENProcess 1e8 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 150 -InterruptEvent 250 -NGENProcess 278 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 278 -NGENProcess 274 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 288 -NGENProcess f4 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent f4 -NGENProcess 250 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent f4 -InterruptEvent 290 -NGENProcess 274 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 288 -NGENProcess 274 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 298 -NGENProcess 250 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 290 -NGENProcess 2a0 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 258 -NGENProcess 250 -Pipe f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 250 -NGENProcess 29c -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 25c -NGENProcess 274 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 274 -NGENProcess 258 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2b0 -NGENProcess 29c -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 29c -NGENProcess 25c -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2b8 -NGENProcess 258 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 258 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2c0 -NGENProcess 25c -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 25c -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2a4 -NGENProcess 2b8 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2b8 -NGENProcess 2d4 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2e0 -NGENProcess 2d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2d8 -NGENProcess 2a4 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2e8 -NGENProcess 2d4 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d4 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f0 -NGENProcess 2a4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2a4 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 304 -NGENProcess 2c0 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2d4 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2c0 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2c0 -NGENProcess 308 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 308 -NGENProcess 2f4 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 31c -NGENProcess 314 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 314 -NGENProcess 2c0 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 324 -NGENProcess 2f4 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 320 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2c0 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2f4 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 320 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2c0 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2f4 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 320 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2c0 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2f4 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 320 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:1488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2c0 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:1300
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2f4 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 320 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2c0 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 2f4 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 320 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 2c0 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 2f4 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:1316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 320 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 2c0 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:1660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 36c -NGENProcess 378 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:2812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 364 -NGENProcess 2c0 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 2c0 -NGENProcess 360 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1364
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 380 -NGENProcess 378 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 37c -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 360 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:3000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 378 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 37c -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2152
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 360 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 378 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:2600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 37c -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 360 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 378 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 37c -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 360 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 378 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:1452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 37c -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:2924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 360 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:1440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 378 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 37c -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 360 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 378 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 37c -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:2648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 360 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:1788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 378 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 37c -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 360 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:1296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 378 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 37c -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 360 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:1600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 378 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 37c -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 360 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3ec -NGENProcess 3f8 -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 378 -NGENProcess 3e4 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 3e4 -NGENProcess 360 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3fc -NGENProcess 3ec -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3ec -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 408 -NGENProcess 360 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 360 -NGENProcess 3fc -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 3e8 -NGENProcess 194 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 194 -NGENProcess 408 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:1260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 410 -NGENProcess 3fc -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:1788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 40c -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:1416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 408 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:1840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3fc -Pipe 198 -Comment "NGen Worker Process"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 40c -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 408 -Pipe 194 -Comment "NGen Worker Process"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 3fc -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:1600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 40c -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 424 -NGENProcess 430 -Pipe 428 -Comment "NGen Worker Process"
  2⤵
  PID:2412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 26c -NGENProcess 40c -Pipe 41c -Comment "NGen Worker Process"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 434 -NGENProcess 42c -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:2300
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 430 -Pipe 134 -Comment "NGen Worker Process"
  2⤵
  PID:2312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 40c -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:2364
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 42c -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 430 -Pipe 424 -Comment "NGen Worker Process"
  2⤵
  PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 40c -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:2904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 42c -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:2544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 450 -NGENProcess 430 -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 454 -NGENProcess 40c -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:3004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 448 -NGENProcess 430 -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 464 -NGENProcess 420 -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 420 -NGENProcess 44c -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 46c -NGENProcess 430 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:2900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 468 -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 474 -NGENProcess 44c -Pipe 448 -Comment "NGen Worker Process"
  2⤵
  PID:1008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 478 -NGENProcess 430 -Pipe 444 -Comment "NGen Worker Process"
  2⤵
  PID:2472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 47c -NGENProcess 468 -Pipe 464 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 468 -NGENProcess 474 -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:2248
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 484 -NGENProcess 430 -Pipe 46c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 430 -NGENProcess 47c -Pipe 480 -Comment "NGen Worker Process"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 48c -NGENProcess 474 -Pipe 478 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 474 -NGENProcess 484 -Pipe 488 -Comment "NGen Worker Process"
  2⤵
  PID:1860

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1460

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

Filesize
640KB

MD5
7f73299cbe72cddf4eaf4fba8e2bfdf5

SHA1
32ad786a1f4cc5ce7a395cb8d35e2df4141e702c

SHA256
93a566ee68b6bbac614ba060d9e0637d76243f486b3ea3b86bd7e54d8efc74e1

SHA512
df88e8ba3885231eefa7d15e4ee3a3e6df6e394e5156741d9e79d2ce12c0b9ac105995fa76b9aace75346f12f05965877a9693e0f0bd1a315b32ef4923645a77

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.5MB

MD5
a68e864960148e5bc0dae2c7bd7210f5

SHA1
3c379f211f0eeb01a666416157e6a24cff717d8f

SHA256
67facb2a3baac0a04a470c994cd8af7492c2fc314a7cd70549469acb87622a82

SHA512
d445165821f636b296f3bf8bcca9e13e808558747d538d332694d74a08c53fe2ade84e221ab83561de6bccab91faef1a6f5a7ca1ae3ec4df7266946429b3b78e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
585ef957502c9f485704f5c7759e29bf

SHA1
d1c0e0bc6f8b33724b1a893a51c358db8769b0fb

SHA256
cd34e4b0ad5371d6d3e762b7f9cbf3117a48e1a6dc21914247c10af97f2f08c0

SHA512
b678418530765b088c6663926653675367655aeee2797e6598a07cf871e3d0b8dc26c28b85d58b7e5ef99d7e1b16b4edae0f6d61cb63649c36759423b82665d0

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.2MB

MD5
a8da7f72cbf9360c9cb6e152e14ab6b8

SHA1
6475017ab836ee685102151234d4b3a3b1badc81

SHA256
3be6958e7e5cbca06a37c4fbaded081e3fc5a7959d25f8b8a3261fa81698b985

SHA512
c1b7199d9f39e8772f21a19920eddb6e51868205af2d1e9ffc04ac196b8b5f9a3e76701981c7f1438926c296226fac7fe36a1ebba3bf7de077b291e4c8e3c68c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
0914363d599ee5c78c2ed9e1fea646c7

SHA1
aa3cec30994ba5a53efed2874c099dc629bd978f

SHA256
0e34e919b59717759ed1c7cca2338f56b39839f60f66972b380d96785d891963

SHA512
078c9bfe0dcc988e9cf83f02b5c54355d32d609ce868c6b661019b1163fd4bd33be2d35ecc7829ada59bfe6e0aa8f47271e1d84efa4461e3840da943a0545be5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
069afe5dfe6216850bdd838e1ac68ad6

SHA1
90d656d48fb9b3aeca7197d5213ea0fa6250d1f9

SHA256
de3e45f5e1c066da12af07972c261e7ced7e3f2115f76aba9f2a56fad167d18c

SHA512
8a4257fd0417b22902d1f4441548d76c21053bc82e083e583a63fffe06d0cd4269d42d8bc000f78bf1c79e24c77887183fd8c4bc45c397e000fa346a71e5d84b

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
559KB

MD5
c022fa6bef158cef223861f573bce1f3

SHA1
ac92c624edea0dc98c23b3713f3884039dfa7f14

SHA256
28123111de2b4abdfdaddbc93bd90e4931f02df5ee7ec5fbed9b77c1fb93724d

SHA512
ca291a9c61bda8b0b8cd7ff86c0dac8c22859bf9c62ea7cb1023489029d3db1d7244546a9dfe0f17903e06ba71bee9cff42fa4b809a56bb69c71ebf1a6c7baaa

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
7fe85265e91bad445609093b0a508761

SHA1
bc9a84cf92b379647490282a75af0577f9492460

SHA256
74205751d8dffec2c86d712367f272c9a7bc2d0aa15c4889eec58894c21dae2e

SHA512
2c03287944b07d4584d4a81747d2c88445bec052177abef9263920eebf43cbf8264bad82c077cb83ee6491f71ed1b80a411efaccbeb9222a75e1a35532934e22

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
590KB

MD5
2e245009192ff4054f234e23ab5e0b8c

SHA1
2d70b06eb51aaf3f029f23429726cbcc16417611

SHA256
e9a16830704fba79218882dafbaea8a8bf8f6886d0118e04954eb5b29e7074d7

SHA512
ab26be2be2b74e6d2a01b4ad70a7d6f2c3d04405849c40bf465ec68f52c83948e31efdcccd6e01827aa584784f9d193df510bc6e9c8bf631a0155825076613e4

Download Submit
C:\Windows\Temp\CabE540.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarE66B.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\1d04b18f7609f45b92967e02ea7234f8\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
0b8b80dfdb6f91591166ee504aa01b75

SHA1
ddf87b403fbbe68f56e76f0622331f643d6f3ae8

SHA256
247320a3bde2fe530abdd36954b53331e209b47edaa071c95af8f878217227ab

SHA512
2d34103cafbd29c5126cdcb847557bece3f027b0761d087a4d23554af9002bee65ef015441c30fc5bd8f2e8be1e1aa47e74557bc45f69fdcdd611562a327b0b6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Filesize
91KB

MD5
adc5887e89bc56694a193d92898d3518

SHA1
267f14c45a86d50ad627c6cb00626049e9c1ee20

SHA256
edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b

SHA512
bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Filesize
1.8MB

MD5
04a6857c04546270358d14398fde209e

SHA1
596a3e11ac6c303c679edfd6c30aa71e8eaf8a23

SHA256
8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285

SHA512
4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Filesize
381KB

MD5
0811b25e0449e04f782127bc6f8ac5e3

SHA1
dc1766e20ee338b12fa80e3ce0052ef97ddf9e20

SHA256
20d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c

SHA512
a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6b2fd10bbaf4e1664b9d452e4af50041\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
9d384392f8f790ed0eeae3995a2598e2

SHA1
70745684ab02db32735fd49d9923ef3455665089

SHA256
624fe210593cfba4beea131b8cb6a0bbe4d963ea5d9950e9533aaad7b222b4d8

SHA512
6f44eebc95476733f660ee900f02f8e2d660d1cacaea678fba1444a8d78a1c8f8fb83387e7a3b41819a1c27a17db45798870094fc53fbced51cb81e9f102d10e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\85a37f210262e918838119e18175f7aa\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
e65471f236d29cb9f14b920887299362

SHA1
5ac5615d174669aab2026bd95fbef498698ae59f

SHA256
0cdef13e054c3754b4b61df29474ff0d0ba7cf81ca0bbaacca1a45af4c6bc3ba

SHA512
8e983a3207025e6f60c3863c0a0eaf68a0559250ba2f0c68a6c6992c0dc026a3a99f8e7156f9232ddcee72af68da8f9b7c71b7942debb103540bec59634e90de

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Filesize
483KB

MD5
aae5a97685a809d0a0f661f9319f8a12

SHA1
b5fdd4ec4cc057fccc868de4f4910be89e23e48a

SHA256
c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233

SHA512
d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\eff1914071b00d996d03b0261aa31c00\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
668ca8482e32847e3f60b5690fde1f00

SHA1
78ece99048638940cd47756127cbd263d5e5715e

SHA256
703fb2f96abfd39e2e579e3c4ddcacdf95e0494b2a09b771ccaffa4bc06ce481

SHA512
16b67307e72f005b21d465233c02eaa04a53f36d3b0bf04994da51d833fee854a5efd3a4e31fee711a3125664e242735059b3cca6dbfa99ebf60206f27fd8076

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
640KB

MD5
7f34ab31a916299e41297e55941bed00

SHA1
7379e33ff54b7bac7e125b67396f50468f4cdcea

SHA256
f171d625e10774ca91fc582c01b32310262ac0a63324fe4aaee73dc031e2de16

SHA512
2ba4f738234287293674a89193c13812d4edf301b4d1632ca39f324161399cdc47dc995b14c26ca10f6e2928cac563a571af549e89b83fde0f61917651af596c

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.0MB

MD5
53a38d8a303dfb5a37d2c657da1011a5

SHA1
d66a56cf83b2a177b3568c6e0c9084b3913a9f12

SHA256
25b97af55e244a5a9bc69d5a1b6a4fb24985b59ede27aa50cdf241259c0a3804

SHA512
e3f8283d85d06dcf7bd69f2092234b068036b23269042585d750ee233d6e49047f08be64bd55868f7b974700b6ae607704bb39dd881784856c333c4654fd3034

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
715KB

MD5
92f779bb9a8dbc96070a164219216afe

SHA1
275c950948001a289b0fde27ddec3636a6000e81

SHA256
95c9250f772e8526b6db43530afe9619dec13d1d24c29127ea8485f6c5dc198e

SHA512
a547f65bc2eef2b50c2f5fff54575d68b3a76abb2a67fdda2b20ee6d15be1b216095fa8ba2076ff2568cb79992649fbb54d23a2f047d350e55dd9708b10f9da9

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
624KB

MD5
5d0ed0d00acbc8e873cb5cebef22550c

SHA1
ea184a1029a980600b14aa7e4326e9c4ed593d39

SHA256
312cfce641833a5129ea9b92f8f5ea2f1c75c9ed45212309eb65980b6287811e

SHA512
f0f491dd0125624e0d2ec5b32f7bc5ecaca449a1d8faad25753cb9883cdfa132d79e0cf97c5076d86f6e53ccb2f870ea7a77a4e462b92f4ba1c02958beb607da

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
536KB

MD5
fed4f09f414635deea48e534cc7049ea

SHA1
9b83823df699efa2a4e7797c96c2bb189c9316f6

SHA256
5cd19ee758ae78747927035e88021e2ce9ab79073c11180f07e4f3afa4d5ab08

SHA512
88d14cf05f2063bc35c54fe2f17712b99fb6a95a27e296db0e0a29762f107caa5d47ce19e24989ebe70cb4b49383b9dd2a884860ecec878305ab055358b0f121

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
577KB

MD5
342cda79523537896a6e086db72b4976

SHA1
2cd706cfd33950a38a3ad37ef68d22755a760c99

SHA256
5ad40ccb7513e110ecab0757aed22c17b567662305e6570e70d70244744fc7ef

SHA512
e6eac3ea706b6fe9db35784a7c03bc172809c4addf4f90b3ede24acc5e719980bb51e9a0d6b31dec92ddf53583af3140b31cb010f35ea28695230aa9bcb25300

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.1MB

MD5
3527fce3314ad99c9a6d37893a46aa0c

SHA1
210568922f7c9ec600b2784585b845a243d6dd11

SHA256
0843a99c8462919569a661f2c7fd111ef8356a05dc99dfd00a92a868dc24e9d7

SHA512
dd0e73e42aa7fb973c752444baa5d6b81de1ebb7c1a5d662e49015cca7d5a86c35993d8851ede46119cc903c5ea6bdb5cd8dc48ffa598e29e35c9d1ba5c094b4

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
638KB

MD5
ec5b14ca3d1fdbbeddc101d33533bbe9

SHA1
da6cb47fd3fb6b2201965f60305a78834f5fe7e7

SHA256
6f5ddfc03f0265c74090146e4af42b2db798e5ae904f0486c0eaa94265d42fb6

SHA512
3613fef1f54d5c92df1c151586f3b3c5f676b5a216265c6080ea75c339edc7d55f77b5de60b04c2a363cc39799b496b815da59edaf6c9c3654aeb75aaeade83c

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
625KB

MD5
4a32898ff900e6d1c82d2870871c0501

SHA1
bbd7ac2f9ffb194d881b537011ce6affa4e962fc

SHA256
073cfdbb8680fc4a2ca1a5a3690cb834d5585f8d33fb2d7a715271c10f106d4d

SHA512
66c61bb663d235430aa3000d87a0da3894d23cf7abdf18c5049bbe803f4941d0920aeb73bd5aa4bf101332a48f6c6a45cc4826ab1cd4e57d8bebb87b5e1591f3

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
514KB

MD5
411dbd905b71d169c44afa8b3b343d04

SHA1
17fe0b0f3ca09d9fe493ef12c3c934e66b4bce22

SHA256
786977675ea008ad7db2cbacb7df26be50c5b9059e5e14e12e6dfd5346eb5348

SHA512
b2b98b2046f2b30359ca56976287e9afb9d16d0733c7b0164e57c15420f6490f991a7e5eebbf06a2883d9712032dd9de1dcf1b9898e14dc584abadc2f29a4baf

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
540KB

MD5
e43299c702973e0975432af8a0cb61a7

SHA1
8cb52eb29a258abe5bcb7a73361e6052b281768a

SHA256
33706c0f2f0dbedce0a5eb54302b5bcbfac2768a561a043b3b412f0a2e7e95b1

SHA512
89f8ebdf117d81327c831a581195213ffbd869e82347f292692be46d6b96a06b8072431b07008d366ee33e3ab5c643fa807e2f062648407360ef1faffc435548

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1021KB

MD5
f82c29b035a577dd72e5ba8119d8601d

SHA1
f688ad511a190f204b255d7f61cd03559b4907ca

SHA256
0741167897192cae7919b5ee4507670b3b65671cd0fda7c4af44ee8805d03836

SHA512
f66d443127c45a79080dbe8c7ae8cf9a1f6a37297e5d8a55b4ec38babdc492bc1f3e9e6118400e79eaa2cfc60dbb29fcf8a7eb121e52990dfd35e13bf13243cd

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.0MB

MD5
02077e67c6fde7fd658767bcb3d70d66

SHA1
4c4e40b171f338d9b643863d61901fe6f118327f

SHA256
02b8be582ead5c910a415bc8766b37e81551500e976fa4a0fef4126c7f8078bc

SHA512
1b60b7002c76434e0c198599cf6ef796576952b3ad3cd8534236e24f20cb24708753586cefca923d23e0c16ea31e8d8ea10e9e737993ffe3777a2dd4e4406674

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
698KB

MD5
41e6a8a2bb25d1b686b046f9bc09177b

SHA1
a28646c2d0afdb11046e44abf330c5e2b54da65f

SHA256
c01e2d9eef9d5bf52609cc26159f97bc7d8aafa084f0692c9db04679bf1ee05c

SHA512
4c02b7141a448994bdae96439ac3dc238957f82dc87585138c9eff2570c92f7d52af11d1472cb53a8034c4329eb0dcd1e08cfde4ad0f6363a1d26e6fddfdf694

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
1.9MB

MD5
078b101aa8d91a247ee29194ace6c201

SHA1
07e453c836e39c4c91a7fa26ee945606a468bbcf

SHA256
b9da7412c02dbcda04e113d9581e8307a90e91a9945eda6138510c3e9b850f31

SHA512
c881d3c2a27e0e048c5d885a94ae9d5b2139fb8c4c7373a70fc4018a2e5c73f361ae3dbdf70679accae60eb8b970b81580b29bfec1c672312c5a9fa3404ee5ac

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
bb10cecd167cf72bd1d3e30ea481f9a8

SHA1
2bd5d03cc3dfd07c228e9a63835dbc8931cee0bd

SHA256
fb6344276bd88f751f5f541dfa8f04b7147ba7c5238e03b836e51fa32678e3a6

SHA512
d9cc11e9cc4f72b34740f8b3e10008f0276ef09990a88d69552eb2944b35033bd4607d52f5b75c7fe99b41890d5cec445d5d4748b20752cdf554d7fdd154764d

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
582KB

MD5
6f3b97591778e90be5c31b9d843dcbd2

SHA1
dc4e137751dc7c4c8ef1d6185b37df14af30c78d

SHA256
1fded5e6ed450ab9f7faa7b222961028510ddb4493a01a84876b6a8ab2d7af12

SHA512
3b0048e88e92015bc36531922039e9053bbe61b42bc9dd32a25ba9b4f0c9776439c90cbebfaeb3152826aa409cedab643e904afa63df7aebeba203d43397aeb6

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7760e00864ef17d873f7250ae09ff209

SHA1
508f99bc4c05ed792caa7baf78208ea723f80c00

SHA256
b94c27a8fc9da9c8035cdb4fbdd8f9505f0ddeeac8c57040e7ee0e8fcd332692

SHA512
35f4b8487c6b04e53ab8e655ea6a13418fdcbabb100031483050141cbe81ebcbd7a76e92bc60f936ad060fe3190fcfc4b6f921073ffb67b387bc654370e5d4bc

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
609KB

MD5
0901605153ef8eace46ff5852e2894cb

SHA1
76b5e789f92d77e8d4d52c62ec5c9da481600a09

SHA256
0ba717f2a178dccc172910f3f1a4c482362e551555d9fb45e83f7af2e1f96cce

SHA512
bcc6deca864f996e0c0709b082aba3a3bc36cf1592474d5363f771986ef887581defb84e1f4f43bef677540d6f4efa013dc0ef133ce8c2c63f9e813beca9e341

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6C5A.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6F08.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP72C0.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP754F.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP77EE.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7A8D.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
memory/388-451-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1448-220-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1448-89-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1448-168-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1460-82-0x0000000140000000-0x0000000140371000-memory.dmp

Filesize
3.4MB

Download
memory/1460-152-0x0000000140000000-0x0000000140371000-memory.dmp

Filesize
3.4MB

Download
memory/1604-172-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1604-150-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1612-304-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1612-301-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1728-299-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1728-302-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1740-369-0x000000001C100000-0x000000001C10C000-memory.dmp

Filesize
48KB

Download
memory/1740-372-0x000000001C4B0000-0x000000001C4C6000-memory.dmp

Filesize
88KB

Download
memory/1740-373-0x000000001C4D0000-0x000000001C518000-memory.dmp

Filesize
288KB

Download
memory/1740-389-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1740-379-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/1740-380-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/1740-370-0x000000001C490000-0x000000001C49C000-memory.dmp

Filesize
48KB

Download
memory/1740-371-0x000000001C4A0000-0x000000001C4AE000-memory.dmp

Filesize
56KB

Download
memory/1740-375-0x000000001C540000-0x000000001C550000-memory.dmp

Filesize
64KB

Download
memory/1740-374-0x000000001C520000-0x000000001C53A000-memory.dmp

Filesize
104KB

Download
memory/1892-461-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1928-338-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1928-336-0x000000001C530000-0x000000001C54E000-memory.dmp

Filesize
120KB

Download
memory/1928-335-0x000000001C510000-0x000000001C52A000-memory.dmp

Filesize
104KB

Download
memory/1928-334-0x0000000000970000-0x000000000097E000-memory.dmp

Filesize
56KB

Download
memory/1928-332-0x0000000000940000-0x0000000000958000-memory.dmp

Filesize
96KB

Download
memory/1968-363-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/1968-365-0x0000000000740000-0x0000000000750000-memory.dmp

Filesize
64KB

Download
memory/1968-367-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2000-344-0x00000000008D0000-0x00000000008EA000-memory.dmp

Filesize
104KB

Download
memory/2000-341-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/2000-353-0x000000001D2C0000-0x000000001D2D8000-memory.dmp

Filesize
96KB

Download
memory/2000-352-0x000000001D2C0000-0x000000001D2D8000-memory.dmp

Filesize
96KB

Download
memory/2000-345-0x0000000003160000-0x000000000317E000-memory.dmp

Filesize
120KB

Download
memory/2000-343-0x0000000000880000-0x00000000008C8000-memory.dmp

Filesize
288KB

Download
memory/2000-342-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/2000-340-0x00000000007C0000-0x00000000007D8000-memory.dmp

Filesize
96KB

Download
memory/2000-362-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2032-171-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2032-173-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2096-306-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2112-412-0x0000000002F60000-0x0000000002F76000-memory.dmp

Filesize
88KB

Download
memory/2112-418-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2112-411-0x0000000002F40000-0x0000000002F5A000-memory.dmp

Filesize
104KB

Download
memory/2168-309-0x0000000003030000-0x0000000003078000-memory.dmp

Filesize
288KB

Download
memory/2168-312-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2168-308-0x0000000000960000-0x000000000096C000-memory.dmp

Filesize
48KB

Download
memory/2168-307-0x0000000000950000-0x000000000095E000-memory.dmp

Filesize
56KB

Download
memory/2168-310-0x0000000002F90000-0x0000000002FA6000-memory.dmp

Filesize
88KB

Download
memory/2264-422-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/2264-417-0x00000000006E0000-0x00000000006F6000-memory.dmp

Filesize
88KB

Download
memory/2264-416-0x00000000006C0000-0x00000000006DA000-memory.dmp

Filesize
104KB

Download
memory/2264-414-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2264-431-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2264-423-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/2284-401-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2284-410-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2284-395-0x0000000000790000-0x000000000079C000-memory.dmp

Filesize
48KB

Download
memory/2284-397-0x000000001C550000-0x000000001C564000-memory.dmp

Filesize
80KB

Download
memory/2284-396-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/2284-402-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2288-462-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2288-464-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2288-463-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/2300-390-0x00000000006A0000-0x00000000006AC000-memory.dmp

Filesize
48KB

Download
memory/2300-391-0x00000000008F0000-0x0000000000904000-memory.dmp

Filesize
80KB

Download
memory/2300-393-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2404-322-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2404-331-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2404-321-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2404-316-0x000000001C470000-0x000000001C4B8000-memory.dmp

Filesize
288KB

Download
memory/2404-315-0x000000001C460000-0x000000001C46C000-memory.dmp

Filesize
48KB

Download
memory/2404-314-0x000000001C100000-0x000000001C10E000-memory.dmp

Filesize
56KB

Download
memory/2404-317-0x000000001C4C0000-0x000000001C4D6000-memory.dmp

Filesize
88KB

Download
memory/2444-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2444-2-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/2444-0-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/2644-21-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/2644-62-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/2644-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2664-437-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/2664-435-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2664-442-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2664-450-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2688-56-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2688-57-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download
memory/2688-151-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2756-63-0x0000000010000000-0x00000000101E1000-memory.dmp

Filesize
1.9MB

Download
memory/2756-36-0x0000000010000000-0x00000000101E1000-memory.dmp

Filesize
1.9MB

Download
memory/2756-35-0x0000000010000000-0x00000000101E1000-memory.dmp

Filesize
1.9MB

Download
memory/2800-433-0x00000000008B0000-0x00000000008BE000-memory.dmp

Filesize
56KB

Download
memory/2800-441-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2800-432-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2980-49-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download