Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
-
Size
645KB
-
MD5
09d607bb679423c3a1636d922b0470a8
-
SHA1
29895b10fbb22ea67adc7c05f9bde69dc79d8f68
-
SHA256
52c44545129a7efe21cc8a3b71a4166af528a5b5142425617dcc907f62471478
-
SHA512
90413037654dec1ecdd469cdc8a863ae82ac586a30f9e683aa1b9e3f8a54bc494fb99860f4fd4af4e5bc1da6974501af5a3c91e063fb762528f2f559a23ce0b6
-
SSDEEP
12288:rYG8GLVeUF+bZnoD2kUQf3zyJQ/aEy+W27jIhyeNnCZ:0G8GLwA+bZWXUQfDyqCINghygnCZ
Malware Config
Signatures
-
Expiro family
-
Expiro payload 3 IoCs
resource yara_rule behavioral1/memory/2444-2-0x0000000000400000-0x00000000005CF000-memory.dmp family_expiro1 behavioral1/memory/2644-62-0x0000000010000000-0x00000000101B7000-memory.dmp family_expiro1 behavioral1/memory/1460-152-0x0000000140000000-0x0000000140371000-memory.dmp family_expiro1 -
Executes dropped EXE 64 IoCs
pid Process 2644 mscorsvw.exe 480 Process not Found 2756 mscorsvw.exe 2980 mscorsvw.exe 2688 mscorsvw.exe 1460 elevation_service.exe 1448 IEEtwCollector.exe 1604 mscorsvw.exe 2032 mscorsvw.exe 1728 mscorsvw.exe 1612 mscorsvw.exe 2096 mscorsvw.exe 2168 mscorsvw.exe 2404 mscorsvw.exe 1928 mscorsvw.exe 2000 mscorsvw.exe 1968 mscorsvw.exe 1740 mscorsvw.exe 2300 mscorsvw.exe 2284 mscorsvw.exe 2112 mscorsvw.exe 2264 mscorsvw.exe 2800 mscorsvw.exe 2664 mscorsvw.exe 388 mscorsvw.exe 1892 mscorsvw.exe 2288 mscorsvw.exe 628 mscorsvw.exe 2192 mscorsvw.exe 2072 mscorsvw.exe 2136 mscorsvw.exe 1632 mscorsvw.exe 2008 mscorsvw.exe 2448 mscorsvw.exe 1968 mscorsvw.exe 2064 mscorsvw.exe 2200 mscorsvw.exe 1884 mscorsvw.exe 1736 mscorsvw.exe 2596 mscorsvw.exe 3008 mscorsvw.exe 788 mscorsvw.exe 2884 mscorsvw.exe 2288 mscorsvw.exe 1316 mscorsvw.exe 900 mscorsvw.exe 1912 mscorsvw.exe 1428 mscorsvw.exe 320 mscorsvw.exe 1740 mscorsvw.exe 2524 mscorsvw.exe 2760 mscorsvw.exe 2824 mscorsvw.exe 1844 mscorsvw.exe 2944 mscorsvw.exe 3004 mscorsvw.exe 1556 mscorsvw.exe 2596 mscorsvw.exe 1192 mscorsvw.exe 2296 mscorsvw.exe 1852 mscorsvw.exe 1684 mscorsvw.exe 1728 mscorsvw.exe 2916 mscorsvw.exe -
Loads dropped DLL 64 IoCs
pid Process 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 2404 mscorsvw.exe 2404 mscorsvw.exe 2000 mscorsvw.exe 2000 mscorsvw.exe 1740 mscorsvw.exe 1740 mscorsvw.exe 2284 mscorsvw.exe 2284 mscorsvw.exe 2264 mscorsvw.exe 2264 mscorsvw.exe 2664 mscorsvw.exe 2664 mscorsvw.exe 1892 mscorsvw.exe 1892 mscorsvw.exe 628 mscorsvw.exe 628 mscorsvw.exe 2072 mscorsvw.exe 2072 mscorsvw.exe 1632 mscorsvw.exe 1632 mscorsvw.exe 2448 mscorsvw.exe 2448 mscorsvw.exe 2064 mscorsvw.exe 2064 mscorsvw.exe 1884 mscorsvw.exe 1884 mscorsvw.exe 2596 mscorsvw.exe 2596 mscorsvw.exe 788 mscorsvw.exe 788 mscorsvw.exe 2288 mscorsvw.exe 2288 mscorsvw.exe 1740 mscorsvw.exe 1740 mscorsvw.exe 2524 mscorsvw.exe 2524 mscorsvw.exe 2824 mscorsvw.exe 2824 mscorsvw.exe 1012 mscorsvw.exe 1012 mscorsvw.exe 1640 mscorsvw.exe 1640 mscorsvw.exe 1372 mscorsvw.exe 1372 mscorsvw.exe 2560 mscorsvw.exe 2560 mscorsvw.exe 1208 mscorsvw.exe 1208 mscorsvw.exe 276 mscorsvw.exe 276 mscorsvw.exe 3004 mscorsvw.exe 3004 mscorsvw.exe 1192 mscorsvw.exe 1192 mscorsvw.exe 2976 mscorsvw.exe 2976 mscorsvw.exe 2304 mscorsvw.exe 2304 mscorsvw.exe 1700 mscorsvw.exe 1700 mscorsvw.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-312935884-697965778-3955649944-1000 mscorsvw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-312935884-697965778-3955649944-1000\EnableNotifications = "0" mscorsvw.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe -
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\N: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\T: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\V: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\Y: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\H: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\G: mscorsvw.exe File opened (read-only) \??\H: mscorsvw.exe File opened (read-only) \??\I: mscorsvw.exe File opened (read-only) \??\P: mscorsvw.exe File opened (read-only) \??\W: mscorsvw.exe File opened (read-only) \??\R: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\E: mscorsvw.exe File opened (read-only) \??\U: mscorsvw.exe File opened (read-only) \??\Z: mscorsvw.exe File opened (read-only) \??\E: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\J: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\L: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\X: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\Q: mscorsvw.exe File opened (read-only) \??\Y: mscorsvw.exe File opened (read-only) \??\O: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\P: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\S: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\U: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\T: mscorsvw.exe File opened (read-only) \??\V: mscorsvw.exe File opened (read-only) \??\I: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\L: mscorsvw.exe File opened (read-only) \??\G: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\K: mscorsvw.exe File opened (read-only) \??\M: mscorsvw.exe File opened (read-only) \??\R: mscorsvw.exe File opened (read-only) \??\S: mscorsvw.exe File opened (read-only) \??\W: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\Z: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\J: mscorsvw.exe File opened (read-only) \??\O: mscorsvw.exe File opened (read-only) \??\X: mscorsvw.exe File opened (read-only) \??\K: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\Q: JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened (read-only) \??\N: mscorsvw.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\dllhost.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\locator.exe mscorsvw.exe File created \??\c:\windows\SysWOW64\svchost.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\vds.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\wbem\wmiApsrv.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\msiexec.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\vds.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\searchindexer.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\fxssvc.exe mscorsvw.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 mscorsvw.exe File opened for modification \??\c:\windows\system32\lsass.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\vssvc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\alg.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\ui0detect.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\SysWOW64\msiexec.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\snmptrap.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\snmptrap.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\searchindexer.exe mscorsvw.exe File created \??\c:\windows\system32\ieetwcollector.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\lsass.exe mscorsvw.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe mscorsvw.exe File created \??\c:\windows\system32\fxssvc.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\wbengine.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\svchost.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\msiexec.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\alg.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\msdtc.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\vds.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\wbengine.exe mscorsvw.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\SysWOW64\searchindexer.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\ieetwcollector.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\msdtc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\ui0detect.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\msiexec.exe mscorsvw.exe File created \??\c:\windows\system32\alg.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\svchost.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\vssvc.exe mscorsvw.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 mscorsvw.exe File opened for modification \??\c:\windows\system32\fxssvc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\locator.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\ui0detect.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\dllhost.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\SysWOW64\dllhost.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\vssvc.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\wbengine.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\windows\system32\msdtc.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\system32\snmptrap.exe mscorsvw.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Internet Explorer\ielowutil.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe mscorsvw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe mscorsvw.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\7-Zip\7zG.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\DVD Maker\DVDMaker.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Program Files\7-Zip\7z.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat mscorsvw.exe File created \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created \??\c:\windows\ehome\ehsched.vir JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPEADC.tmp\Microsoft.Office.Tools.Excel.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index160.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15e.dat mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8A26.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15f.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index161.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index160.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15f.dat mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index15d.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9415.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "mscorsvw.exe" mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2444 JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeTakeOwnershipPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe Token: SeShutdownPrivilege 2688 mscorsvw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 1604 2688 mscorsvw.exe 37 PID 2688 wrote to memory of 1604 2688 mscorsvw.exe 37 PID 2688 wrote to memory of 1604 2688 mscorsvw.exe 37 PID 2688 wrote to memory of 2032 2688 mscorsvw.exe 39 PID 2688 wrote to memory of 2032 2688 mscorsvw.exe 39 PID 2688 wrote to memory of 2032 2688 mscorsvw.exe 39 PID 2688 wrote to memory of 1728 2688 mscorsvw.exe 40 PID 2688 wrote to memory of 1728 2688 mscorsvw.exe 40 PID 2688 wrote to memory of 1728 2688 mscorsvw.exe 40 PID 2688 wrote to memory of 1612 2688 mscorsvw.exe 41 PID 2688 wrote to memory of 1612 2688 mscorsvw.exe 41 PID 2688 wrote to memory of 1612 2688 mscorsvw.exe 41 PID 2688 wrote to memory of 2096 2688 mscorsvw.exe 42 PID 2688 wrote to memory of 2096 2688 mscorsvw.exe 42 PID 2688 wrote to memory of 2096 2688 mscorsvw.exe 42 PID 2688 wrote to memory of 2168 2688 mscorsvw.exe 43 PID 2688 wrote to memory of 2168 2688 mscorsvw.exe 43 PID 2688 wrote to memory of 2168 2688 mscorsvw.exe 43 PID 2688 wrote to memory of 2404 2688 mscorsvw.exe 44 PID 2688 wrote to memory of 2404 2688 mscorsvw.exe 44 PID 2688 wrote to memory of 2404 2688 mscorsvw.exe 44 PID 2688 wrote to memory of 1928 2688 mscorsvw.exe 45 PID 2688 wrote to memory of 1928 2688 mscorsvw.exe 45 PID 2688 wrote to memory of 1928 2688 mscorsvw.exe 45 PID 2688 wrote to memory of 2000 2688 mscorsvw.exe 46 PID 2688 wrote to memory of 2000 2688 mscorsvw.exe 46 PID 2688 wrote to memory of 2000 2688 mscorsvw.exe 46 PID 2688 wrote to memory of 1968 2688 mscorsvw.exe 47 PID 2688 wrote to memory of 1968 2688 mscorsvw.exe 47 PID 2688 wrote to memory of 1968 2688 mscorsvw.exe 47 PID 2688 wrote to memory of 1740 2688 mscorsvw.exe 48 PID 2688 wrote to memory of 1740 2688 mscorsvw.exe 48 PID 2688 wrote to memory of 1740 2688 mscorsvw.exe 48 PID 2688 wrote to memory of 2300 2688 mscorsvw.exe 50 PID 2688 wrote to memory of 2300 2688 mscorsvw.exe 50 PID 2688 wrote to memory of 2300 2688 mscorsvw.exe 50 PID 2688 wrote to memory of 2284 2688 mscorsvw.exe 51 PID 2688 wrote to memory of 2284 2688 mscorsvw.exe 51 PID 2688 wrote to memory of 2284 2688 mscorsvw.exe 51 PID 2688 wrote to memory of 2112 2688 mscorsvw.exe 52 PID 2688 wrote to memory of 2112 2688 mscorsvw.exe 52 PID 2688 wrote to memory of 2112 2688 mscorsvw.exe 52 PID 2688 wrote to memory of 2264 2688 mscorsvw.exe 53 PID 2688 wrote to memory of 2264 2688 mscorsvw.exe 53 PID 2688 wrote to memory of 2264 2688 mscorsvw.exe 53 PID 2688 wrote to memory of 2800 2688 mscorsvw.exe 54 PID 2688 wrote to memory of 2800 2688 mscorsvw.exe 54 PID 2688 wrote to memory of 2800 2688 mscorsvw.exe 54 PID 2688 wrote to memory of 2664 2688 mscorsvw.exe 55 PID 2688 wrote to memory of 2664 2688 mscorsvw.exe 55 PID 2688 wrote to memory of 2664 2688 mscorsvw.exe 55 PID 2688 wrote to memory of 388 2688 mscorsvw.exe 56 PID 2688 wrote to memory of 388 2688 mscorsvw.exe 56 PID 2688 wrote to memory of 388 2688 mscorsvw.exe 56 PID 2688 wrote to memory of 1892 2688 mscorsvw.exe 57 PID 2688 wrote to memory of 1892 2688 mscorsvw.exe 57 PID 2688 wrote to memory of 1892 2688 mscorsvw.exe 57 PID 2688 wrote to memory of 2288 2688 mscorsvw.exe 58 PID 2688 wrote to memory of 2288 2688 mscorsvw.exe 58 PID 2688 wrote to memory of 2288 2688 mscorsvw.exe 58 PID 2688 wrote to memory of 628 2688 mscorsvw.exe 59 PID 2688 wrote to memory of 628 2688 mscorsvw.exe 59 PID 2688 wrote to memory of 628 2688 mscorsvw.exe 59 PID 2688 wrote to memory of 2192 2688 mscorsvw.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe"1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2644
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2756
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2980
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1604
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 238 -NGENProcess 244 -Pipe 22c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2032
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 1e4 -NGENProcess 150 -Pipe 184 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1728
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 268 -NGENProcess 1e8 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1612
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2096
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 150 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2168
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 1e8 -Pipe 15c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2404
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 150 -NGENProcess 1e8 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1928
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 150 -InterruptEvent 250 -NGENProcess 278 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 278 -NGENProcess 274 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 288 -NGENProcess f4 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1740
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent f4 -NGENProcess 250 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent f4 -InterruptEvent 290 -NGENProcess 274 -Pipe 150 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2284
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 288 -NGENProcess 274 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2112
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 298 -NGENProcess 250 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 290 -NGENProcess 2a0 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2800
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 258 -NGENProcess 250 -Pipe f4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 250 -NGENProcess 29c -Pipe 298 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:388
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 25c -NGENProcess 274 -Pipe 2a0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1892
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 274 -NGENProcess 258 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2b0 -NGENProcess 29c -Pipe 290 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 29c -NGENProcess 25c -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2b8 -NGENProcess 258 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2072
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 258 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2136
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2c0 -NGENProcess 25c -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1632
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 25c -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2448
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2064
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2b0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2200
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2a4 -NGENProcess 2b8 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1884
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2b8 -NGENProcess 2d4 -Pipe 2d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1736
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2e0 -NGENProcess 2d8 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2596
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2d8 -NGENProcess 2a4 -Pipe 2dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2e8 -NGENProcess 2d4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:788
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d4 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2884
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f0 -NGENProcess 2a4 -Pipe 2b8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2a4 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:900
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 304 -NGENProcess 2c0 -Pipe 300 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1912
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2d4 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1428
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:320
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2c0 -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1740
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2c0 -NGENProcess 308 -Pipe 2d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2524
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 308 -NGENProcess 2f4 -Pipe 2d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 31c -NGENProcess 314 -Pipe 304 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2824
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 314 -NGENProcess 2c0 -Pipe 318 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1844
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 324 -NGENProcess 2f4 -Pipe 310 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 320 -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3004
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2c0 -Pipe 308 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1556
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2f4 -Pipe 30c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2596
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 320 -Pipe 31c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2c0 -Pipe 314 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2296
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2f4 -Pipe 324 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1852
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 320 -Pipe 328 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2c0 -Pipe 32c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1728
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2f4 -Pipe 330 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2916
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 320 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:1488
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2c0 -Pipe 338 -Comment "NGen Worker Process"2⤵PID:1300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2f4 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 320 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2c0 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:1604
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 2f4 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 320 -Pipe 34c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1700
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 2c0 -Pipe 350 -Comment "NGen Worker Process"2⤵PID:2008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 2f4 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 320 -Pipe 358 -Comment "NGen Worker Process"2⤵PID:2380
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 2c0 -Pipe 35c -Comment "NGen Worker Process"2⤵PID:1660
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 36c -NGENProcess 378 -Pipe 370 -Comment "NGen Worker Process"2⤵PID:2812
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 364 -NGENProcess 2c0 -Pipe 2fc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 2c0 -NGENProcess 360 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:1364
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 380 -NGENProcess 378 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:548
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 37c -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:1964
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 360 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:3000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 378 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:2740
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 37c -Pipe 364 -Comment "NGen Worker Process"2⤵PID:2152
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 360 -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:2880
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 378 -Pipe 380 -Comment "NGen Worker Process"2⤵PID:2600
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 37c -Pipe 384 -Comment "NGen Worker Process"2⤵PID:2944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 360 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:2560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 378 -Pipe 38c -Comment "NGen Worker Process"2⤵PID:2604
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 37c -Pipe 390 -Comment "NGen Worker Process"2⤵PID:1984
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 360 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 378 -Pipe 398 -Comment "NGen Worker Process"2⤵PID:1452
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 37c -Pipe 39c -Comment "NGen Worker Process"2⤵PID:2924
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 360 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:1440
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 378 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 37c -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:276
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 360 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:1224
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 378 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:840
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 37c -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:2648
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 360 -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:1788
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 378 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:2996
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 37c -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:1632
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 360 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:1296
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 378 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:1704
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 37c -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:2780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 360 -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:1600
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 378 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:892
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 37c -Pipe 3d8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2224
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 360 -Pipe 3dc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3ec -NGENProcess 3f8 -Pipe 3f0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2356
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 378 -NGENProcess 3e4 -Pipe 3e0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1372
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 3e4 -NGENProcess 360 -Pipe 3f8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2488
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3fc -NGENProcess 3ec -Pipe 3f4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3ec -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 408 -NGENProcess 360 -Pipe 368 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1208
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 360 -NGENProcess 3fc -Pipe 404 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2360
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 3e8 -NGENProcess 194 -Pipe 378 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:276
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 194 -NGENProcess 408 -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:1260
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 410 -NGENProcess 3fc -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:1788
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 40c -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:1416
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 408 -Pipe 360 -Comment "NGen Worker Process"2⤵PID:1840
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3fc -Pipe 198 -Comment "NGen Worker Process"2⤵PID:1676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 40c -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:1704
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 408 -Pipe 194 -Comment "NGen Worker Process"2⤵PID:2780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 3fc -Pipe 410 -Comment "NGen Worker Process"2⤵PID:1600
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 40c -Pipe 414 -Comment "NGen Worker Process"2⤵PID:2708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 424 -NGENProcess 430 -Pipe 428 -Comment "NGen Worker Process"2⤵PID:2412
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 26c -NGENProcess 40c -Pipe 41c -Comment "NGen Worker Process"2⤵PID:3040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 434 -NGENProcess 42c -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:2300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 430 -Pipe 134 -Comment "NGen Worker Process"2⤵PID:2312
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 40c -Pipe 408 -Comment "NGen Worker Process"2⤵PID:2364
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 42c -Pipe 418 -Comment "NGen Worker Process"2⤵PID:944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 430 -Pipe 424 -Comment "NGen Worker Process"2⤵PID:2524
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 40c -Pipe 26c -Comment "NGen Worker Process"2⤵PID:2904
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 42c -Pipe 434 -Comment "NGen Worker Process"2⤵PID:2544
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 450 -NGENProcess 430 -Pipe 438 -Comment "NGen Worker Process"2⤵PID:804
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 454 -NGENProcess 40c -Pipe 43c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3004
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 448 -NGENProcess 430 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:596
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 464 -NGENProcess 420 -Pipe 460 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 420 -NGENProcess 44c -Pipe 40c -Comment "NGen Worker Process"2⤵PID:788
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 46c -NGENProcess 430 -Pipe 440 -Comment "NGen Worker Process"2⤵PID:2900
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 468 -Pipe 458 -Comment "NGen Worker Process"2⤵PID:2884
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 474 -NGENProcess 44c -Pipe 448 -Comment "NGen Worker Process"2⤵PID:1008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 478 -NGENProcess 430 -Pipe 444 -Comment "NGen Worker Process"2⤵PID:2472
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 47c -NGENProcess 468 -Pipe 464 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2976
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 468 -NGENProcess 474 -Pipe 44c -Comment "NGen Worker Process"2⤵PID:2248
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 484 -NGENProcess 430 -Pipe 46c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2304
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 430 -NGENProcess 47c -Pipe 480 -Comment "NGen Worker Process"2⤵PID:684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 48c -NGENProcess 474 -Pipe 478 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1700
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 474 -NGENProcess 484 -Pipe 488 -Comment "NGen Worker Process"2⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1460
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:1448
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
MD57f73299cbe72cddf4eaf4fba8e2bfdf5
SHA132ad786a1f4cc5ce7a395cb8d35e2df4141e702c
SHA25693a566ee68b6bbac614ba060d9e0637d76243f486b3ea3b86bd7e54d8efc74e1
SHA512df88e8ba3885231eefa7d15e4ee3a3e6df6e394e5156741d9e79d2ce12c0b9ac105995fa76b9aace75346f12f05965877a9693e0f0bd1a315b32ef4923645a77
-
Filesize
1.5MB
MD5a68e864960148e5bc0dae2c7bd7210f5
SHA13c379f211f0eeb01a666416157e6a24cff717d8f
SHA25667facb2a3baac0a04a470c994cd8af7492c2fc314a7cd70549469acb87622a82
SHA512d445165821f636b296f3bf8bcca9e13e808558747d538d332694d74a08c53fe2ade84e221ab83561de6bccab91faef1a6f5a7ca1ae3ec4df7266946429b3b78e
-
Filesize
4.8MB
MD5585ef957502c9f485704f5c7759e29bf
SHA1d1c0e0bc6f8b33724b1a893a51c358db8769b0fb
SHA256cd34e4b0ad5371d6d3e762b7f9cbf3117a48e1a6dc21914247c10af97f2f08c0
SHA512b678418530765b088c6663926653675367655aeee2797e6598a07cf871e3d0b8dc26c28b85d58b7e5ef99d7e1b16b4edae0f6d61cb63649c36759423b82665d0
-
Filesize
1.2MB
MD5a8da7f72cbf9360c9cb6e152e14ab6b8
SHA16475017ab836ee685102151234d4b3a3b1badc81
SHA2563be6958e7e5cbca06a37c4fbaded081e3fc5a7959d25f8b8a3261fa81698b985
SHA512c1b7199d9f39e8772f21a19920eddb6e51868205af2d1e9ffc04ac196b8b5f9a3e76701981c7f1438926c296226fac7fe36a1ebba3bf7de077b291e4c8e3c68c
-
Filesize
872KB
MD50914363d599ee5c78c2ed9e1fea646c7
SHA1aa3cec30994ba5a53efed2874c099dc629bd978f
SHA2560e34e919b59717759ed1c7cca2338f56b39839f60f66972b380d96785d891963
SHA512078c9bfe0dcc988e9cf83f02b5c54355d32d609ce868c6b661019b1163fd4bd33be2d35ecc7829ada59bfe6e0aa8f47271e1d84efa4461e3840da943a0545be5
-
Filesize
8KB
MD5069afe5dfe6216850bdd838e1ac68ad6
SHA190d656d48fb9b3aeca7197d5213ea0fa6250d1f9
SHA256de3e45f5e1c066da12af07972c261e7ced7e3f2115f76aba9f2a56fad167d18c
SHA5128a4257fd0417b22902d1f4441548d76c21053bc82e083e583a63fffe06d0cd4269d42d8bc000f78bf1c79e24c77887183fd8c4bc45c397e000fa346a71e5d84b
-
Filesize
559KB
MD5c022fa6bef158cef223861f573bce1f3
SHA1ac92c624edea0dc98c23b3713f3884039dfa7f14
SHA25628123111de2b4abdfdaddbc93bd90e4931f02df5ee7ec5fbed9b77c1fb93724d
SHA512ca291a9c61bda8b0b8cd7ff86c0dac8c22859bf9c62ea7cb1023489029d3db1d7244546a9dfe0f17903e06ba71bee9cff42fa4b809a56bb69c71ebf1a6c7baaa
-
Filesize
1003KB
MD57fe85265e91bad445609093b0a508761
SHA1bc9a84cf92b379647490282a75af0577f9492460
SHA25674205751d8dffec2c86d712367f272c9a7bc2d0aa15c4889eec58894c21dae2e
SHA5122c03287944b07d4584d4a81747d2c88445bec052177abef9263920eebf43cbf8264bad82c077cb83ee6491f71ed1b80a411efaccbeb9222a75e1a35532934e22
-
Filesize
590KB
MD52e245009192ff4054f234e23ab5e0b8c
SHA12d70b06eb51aaf3f029f23429726cbcc16417611
SHA256e9a16830704fba79218882dafbaea8a8bf8f6886d0118e04954eb5b29e7074d7
SHA512ab26be2be2b74e6d2a01b4ad70a7d6f2c3d04405849c40bf465ec68f52c83948e31efdcccd6e01827aa584784f9d193df510bc6e9c8bf631a0155825076613e4
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
Filesize105KB
MD5d9c0055c0c93a681947027f5282d5dcd
SHA19bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA5125404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize1.1MB
MD57835e60e560a49049ae728698da3d301
SHA187b357b1b3c9a2ad2f3b89b10a42af021ab76afe
SHA256df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa
SHA512b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize238KB
MD50a4ed78b7995d94fa42379f84cd5f8e9
SHA190ba188fe0ebd38ad225e7ce3a24dd9b6b68056b
SHA2560a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86
SHA51286ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.8MB
MD59958f23efa2a86f8195f11054f94189a
SHA178ec93b44569ea7ebce452765568da5c73511931
SHA2563235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6
SHA5123061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize1.0MB
MD5598a06ea8f1611a24f86bc0bef0f547e
SHA15a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\1d04b18f7609f45b92967e02ea7234f8\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize271KB
MD50b8b80dfdb6f91591166ee504aa01b75
SHA1ddf87b403fbbe68f56e76f0622331f643d6f3ae8
SHA256247320a3bde2fe530abdd36954b53331e209b47edaa071c95af8f878217227ab
SHA5122d34103cafbd29c5126cdcb847557bece3f027b0761d087a4d23554af9002bee65ef015441c30fc5bd8f2e8be1e1aa47e74557bc45f69fdcdd611562a327b0b6
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Filesize91KB
MD5adc5887e89bc56694a193d92898d3518
SHA1267f14c45a86d50ad627c6cb00626049e9c1ee20
SHA256edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b
SHA512bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Filesize1.8MB
MD504a6857c04546270358d14398fde209e
SHA1596a3e11ac6c303c679edfd6c30aa71e8eaf8a23
SHA2568eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285
SHA5124e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
Filesize381KB
MD50811b25e0449e04f782127bc6f8ac5e3
SHA1dc1766e20ee338b12fa80e3ce0052ef97ddf9e20
SHA25620d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c
SHA512a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6b2fd10bbaf4e1664b9d452e4af50041\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize221KB
MD59d384392f8f790ed0eeae3995a2598e2
SHA170745684ab02db32735fd49d9923ef3455665089
SHA256624fe210593cfba4beea131b8cb6a0bbe4d963ea5d9950e9533aaad7b222b4d8
SHA5126f44eebc95476733f660ee900f02f8e2d660d1cacaea678fba1444a8d78a1c8f8fb83387e7a3b41819a1c27a17db45798870094fc53fbced51cb81e9f102d10e
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\85a37f210262e918838119e18175f7aa\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize122KB
MD5e65471f236d29cb9f14b920887299362
SHA15ac5615d174669aab2026bd95fbef498698ae59f
SHA2560cdef13e054c3754b4b61df29474ff0d0ba7cf81ca0bbaacca1a45af4c6bc3ba
SHA5128e983a3207025e6f60c3863c0a0eaf68a0559250ba2f0c68a6c6992c0dc026a3a99f8e7156f9232ddcee72af68da8f9b7c71b7942debb103540bec59634e90de
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Filesize483KB
MD5aae5a97685a809d0a0f661f9319f8a12
SHA1b5fdd4ec4cc057fccc868de4f4910be89e23e48a
SHA256c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233
SHA512d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\eff1914071b00d996d03b0261aa31c00\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize305KB
MD5668ca8482e32847e3f60b5690fde1f00
SHA178ece99048638940cd47756127cbd263d5e5715e
SHA256703fb2f96abfd39e2e579e3c4ddcacdf95e0494b2a09b771ccaffa4bc06ce481
SHA51216b67307e72f005b21d465233c02eaa04a53f36d3b0bf04994da51d833fee854a5efd3a4e31fee711a3125664e242735059b3cca6dbfa99ebf60206f27fd8076
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
Filesize124KB
MD5929653b5b019b4555b25d55e6bf9987b
SHA1993844805819ee445ff8136ee38c1aee70de3180
SHA2562766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
Filesize2.1MB
MD510b5a285eafccdd35390bb49861657e7
SHA162c05a4380e68418463529298058f3d2de19660d
SHA2565f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA51219ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
Filesize88KB
MD51f394b5ca6924de6d9dbfb0e90ea50ef
SHA14e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA2569db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
-
Filesize
640KB
MD57f34ab31a916299e41297e55941bed00
SHA17379e33ff54b7bac7e125b67396f50468f4cdcea
SHA256f171d625e10774ca91fc582c01b32310262ac0a63324fe4aaee73dc031e2de16
SHA5122ba4f738234287293674a89193c13812d4edf301b4d1632ca39f324161399cdc47dc995b14c26ca10f6e2928cac563a571af549e89b83fde0f61917651af596c
-
Filesize
30.0MB
MD553a38d8a303dfb5a37d2c657da1011a5
SHA1d66a56cf83b2a177b3568c6e0c9084b3913a9f12
SHA25625b97af55e244a5a9bc69d5a1b6a4fb24985b59ede27aa50cdf241259c0a3804
SHA512e3f8283d85d06dcf7bd69f2092234b068036b23269042585d750ee233d6e49047f08be64bd55868f7b974700b6ae607704bb39dd881784856c333c4654fd3034
-
Filesize
715KB
MD592f779bb9a8dbc96070a164219216afe
SHA1275c950948001a289b0fde27ddec3636a6000e81
SHA25695c9250f772e8526b6db43530afe9619dec13d1d24c29127ea8485f6c5dc198e
SHA512a547f65bc2eef2b50c2f5fff54575d68b3a76abb2a67fdda2b20ee6d15be1b216095fa8ba2076ff2568cb79992649fbb54d23a2f047d350e55dd9708b10f9da9
-
Filesize
624KB
MD55d0ed0d00acbc8e873cb5cebef22550c
SHA1ea184a1029a980600b14aa7e4326e9c4ed593d39
SHA256312cfce641833a5129ea9b92f8f5ea2f1c75c9ed45212309eb65980b6287811e
SHA512f0f491dd0125624e0d2ec5b32f7bc5ecaca449a1d8faad25753cb9883cdfa132d79e0cf97c5076d86f6e53ccb2f870ea7a77a4e462b92f4ba1c02958beb607da
-
Filesize
536KB
MD5fed4f09f414635deea48e534cc7049ea
SHA19b83823df699efa2a4e7797c96c2bb189c9316f6
SHA2565cd19ee758ae78747927035e88021e2ce9ab79073c11180f07e4f3afa4d5ab08
SHA51288d14cf05f2063bc35c54fe2f17712b99fb6a95a27e296db0e0a29762f107caa5d47ce19e24989ebe70cb4b49383b9dd2a884860ecec878305ab055358b0f121
-
Filesize
577KB
MD5342cda79523537896a6e086db72b4976
SHA12cd706cfd33950a38a3ad37ef68d22755a760c99
SHA2565ad40ccb7513e110ecab0757aed22c17b567662305e6570e70d70244744fc7ef
SHA512e6eac3ea706b6fe9db35784a7c03bc172809c4addf4f90b3ede24acc5e719980bb51e9a0d6b31dec92ddf53583af3140b31cb010f35ea28695230aa9bcb25300
-
Filesize
1.1MB
MD53527fce3314ad99c9a6d37893a46aa0c
SHA1210568922f7c9ec600b2784585b845a243d6dd11
SHA2560843a99c8462919569a661f2c7fd111ef8356a05dc99dfd00a92a868dc24e9d7
SHA512dd0e73e42aa7fb973c752444baa5d6b81de1ebb7c1a5d662e49015cca7d5a86c35993d8851ede46119cc903c5ea6bdb5cd8dc48ffa598e29e35c9d1ba5c094b4
-
Filesize
638KB
MD5ec5b14ca3d1fdbbeddc101d33533bbe9
SHA1da6cb47fd3fb6b2201965f60305a78834f5fe7e7
SHA2566f5ddfc03f0265c74090146e4af42b2db798e5ae904f0486c0eaa94265d42fb6
SHA5123613fef1f54d5c92df1c151586f3b3c5f676b5a216265c6080ea75c339edc7d55f77b5de60b04c2a363cc39799b496b815da59edaf6c9c3654aeb75aaeade83c
-
Filesize
625KB
MD54a32898ff900e6d1c82d2870871c0501
SHA1bbd7ac2f9ffb194d881b537011ce6affa4e962fc
SHA256073cfdbb8680fc4a2ca1a5a3690cb834d5585f8d33fb2d7a715271c10f106d4d
SHA51266c61bb663d235430aa3000d87a0da3894d23cf7abdf18c5049bbe803f4941d0920aeb73bd5aa4bf101332a48f6c6a45cc4826ab1cd4e57d8bebb87b5e1591f3
-
Filesize
514KB
MD5411dbd905b71d169c44afa8b3b343d04
SHA117fe0b0f3ca09d9fe493ef12c3c934e66b4bce22
SHA256786977675ea008ad7db2cbacb7df26be50c5b9059e5e14e12e6dfd5346eb5348
SHA512b2b98b2046f2b30359ca56976287e9afb9d16d0733c7b0164e57c15420f6490f991a7e5eebbf06a2883d9712032dd9de1dcf1b9898e14dc584abadc2f29a4baf
-
Filesize
540KB
MD5e43299c702973e0975432af8a0cb61a7
SHA18cb52eb29a258abe5bcb7a73361e6052b281768a
SHA25633706c0f2f0dbedce0a5eb54302b5bcbfac2768a561a043b3b412f0a2e7e95b1
SHA51289f8ebdf117d81327c831a581195213ffbd869e82347f292692be46d6b96a06b8072431b07008d366ee33e3ab5c643fa807e2f062648407360ef1faffc435548
-
Filesize
1021KB
MD5f82c29b035a577dd72e5ba8119d8601d
SHA1f688ad511a190f204b255d7f61cd03559b4907ca
SHA2560741167897192cae7919b5ee4507670b3b65671cd0fda7c4af44ee8805d03836
SHA512f66d443127c45a79080dbe8c7ae8cf9a1f6a37297e5d8a55b4ec38babdc492bc1f3e9e6118400e79eaa2cfc60dbb29fcf8a7eb121e52990dfd35e13bf13243cd
-
Filesize
2.0MB
MD502077e67c6fde7fd658767bcb3d70d66
SHA14c4e40b171f338d9b643863d61901fe6f118327f
SHA25602b8be582ead5c910a415bc8766b37e81551500e976fa4a0fef4126c7f8078bc
SHA5121b60b7002c76434e0c198599cf6ef796576952b3ad3cd8534236e24f20cb24708753586cefca923d23e0c16ea31e8d8ea10e9e737993ffe3777a2dd4e4406674
-
Filesize
698KB
MD541e6a8a2bb25d1b686b046f9bc09177b
SHA1a28646c2d0afdb11046e44abf330c5e2b54da65f
SHA256c01e2d9eef9d5bf52609cc26159f97bc7d8aafa084f0692c9db04679bf1ee05c
SHA5124c02b7141a448994bdae96439ac3dc238957f82dc87585138c9eff2570c92f7d52af11d1472cb53a8034c4329eb0dcd1e08cfde4ad0f6363a1d26e6fddfdf694
-
Filesize
1.9MB
MD5078b101aa8d91a247ee29194ace6c201
SHA107e453c836e39c4c91a7fa26ee945606a468bbcf
SHA256b9da7412c02dbcda04e113d9581e8307a90e91a9945eda6138510c3e9b850f31
SHA512c881d3c2a27e0e048c5d885a94ae9d5b2139fb8c4c7373a70fc4018a2e5c73f361ae3dbdf70679accae60eb8b970b81580b29bfec1c672312c5a9fa3404ee5ac
-
Filesize
2.1MB
MD5bb10cecd167cf72bd1d3e30ea481f9a8
SHA12bd5d03cc3dfd07c228e9a63835dbc8931cee0bd
SHA256fb6344276bd88f751f5f541dfa8f04b7147ba7c5238e03b836e51fa32678e3a6
SHA512d9cc11e9cc4f72b34740f8b3e10008f0276ef09990a88d69552eb2944b35033bd4607d52f5b75c7fe99b41890d5cec445d5d4748b20752cdf554d7fdd154764d
-
Filesize
582KB
MD56f3b97591778e90be5c31b9d843dcbd2
SHA1dc4e137751dc7c4c8ef1d6185b37df14af30c78d
SHA2561fded5e6ed450ab9f7faa7b222961028510ddb4493a01a84876b6a8ab2d7af12
SHA5123b0048e88e92015bc36531922039e9053bbe61b42bc9dd32a25ba9b4f0c9776439c90cbebfaeb3152826aa409cedab643e904afa63df7aebeba203d43397aeb6
-
Filesize
610KB
MD57760e00864ef17d873f7250ae09ff209
SHA1508f99bc4c05ed792caa7baf78208ea723f80c00
SHA256b94c27a8fc9da9c8035cdb4fbdd8f9505f0ddeeac8c57040e7ee0e8fcd332692
SHA51235f4b8487c6b04e53ab8e655ea6a13418fdcbabb100031483050141cbe81ebcbd7a76e92bc60f936ad060fe3190fcfc4b6f921073ffb67b387bc654370e5d4bc
-
Filesize
609KB
MD50901605153ef8eace46ff5852e2894cb
SHA176b5e789f92d77e8d4d52c62ec5c9da481600a09
SHA2560ba717f2a178dccc172910f3f1a4c482362e551555d9fb45e83f7af2e1f96cce
SHA512bcc6deca864f996e0c0709b082aba3a3bc36cf1592474d5363f771986ef887581defb84e1f4f43bef677540d6f4efa013dc0ef133ce8c2c63f9e813beca9e341
-
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6C5A.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll
Filesize85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6F08.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll
Filesize298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP72C0.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll
Filesize58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP754F.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll
Filesize58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
Filesize
248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7A8D.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Filesize87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a