expiro | f02afc1a59cb84471acb358889aeec2e83f6d5e2857e452093e593ad40eb1bbc

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
Size

520KB
MD5

52ec5fefeafaf1ccec560df7ecee6af7
SHA1

732d242bc25b2b9778b9dfeeadbccc086afad820
SHA256

f02afc1a59cb84471acb358889aeec2e83f6d5e2857e452093e593ad40eb1bbc
SHA512

a28505051de5d939ef0ee6508c2b4ecbc9a3460571a6721fc6bed40b9b9e795086a892305d383d709d2f0905a928c1ee700e4c34ca6df0b6926bb71b8ebf7a06
SSDEEP

12288:BCIYdMeN7hyk5O4w6X8TDKAkqLM3UsPxn4+633RWTbqOYYw+TMEA0Ld:tYHlykdAkqLM3UmJI3EmN+TMEA0Ld

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral1/memory/1552-2-0x0000000001000000-0x000000000119E000-memory.dmp	family_expiro1
behavioral1/memory/2668-54-0x0000000010000000-0x00000000101A9000-memory.dmp	family_expiro1

Executes dropped EXE 64 IoCs

pid	Process
2668	mscorsvw.exe
476	Process not Found
2664	mscorsvw.exe
2832	mscorsvw.exe
2908	mscorsvw.exe
1316	elevation_service.exe
2324	IEEtwCollector.exe
484	mscorsvw.exe
2228	mscorsvw.exe
1940	mscorsvw.exe
2840	mscorsvw.exe
2900	mscorsvw.exe
2220	mscorsvw.exe
2508	mscorsvw.exe
1268	mscorsvw.exe
1532	mscorsvw.exe
2244	mscorsvw.exe
628	mscorsvw.exe
2692	mscorsvw.exe
2236	mscorsvw.exe
2356	mscorsvw.exe
2084	mscorsvw.exe
2072	mscorsvw.exe
2792	mscorsvw.exe
2592	mscorsvw.exe
1232	mscorsvw.exe
388	mscorsvw.exe
1220	mscorsvw.exe
2536	mscorsvw.exe
688	mscorsvw.exe
2308	mscorsvw.exe
2396	mscorsvw.exe
2500	mscorsvw.exe
2176	mscorsvw.exe
1936	mscorsvw.exe
2488	mscorsvw.exe
1496	mscorsvw.exe
2680	mscorsvw.exe
2588	mscorsvw.exe
2584	mscorsvw.exe
2568	mscorsvw.exe
2936	mscorsvw.exe
2824	mscorsvw.exe
2548	mscorsvw.exe
1992	mscorsvw.exe
2388	mscorsvw.exe
2180	mscorsvw.exe
2056	mscorsvw.exe
3024	mscorsvw.exe
1944	mscorsvw.exe
2696	mscorsvw.exe
2888	mscorsvw.exe
1200	mscorsvw.exe
2604	mscorsvw.exe
2464	mscorsvw.exe
2084	mscorsvw.exe
828	mscorsvw.exe
1072	mscorsvw.exe
1904	mscorsvw.exe
2792	mscorsvw.exe
2728	mscorsvw.exe
2996	mscorsvw.exe
2268	mscorsvw.exe
2220	mscorsvw.exe

Loads dropped DLL 50 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
2508	mscorsvw.exe
2508	mscorsvw.exe
1532	mscorsvw.exe
1532	mscorsvw.exe
628	mscorsvw.exe
628	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2084	mscorsvw.exe
2084	mscorsvw.exe
2792	mscorsvw.exe
2792	mscorsvw.exe
1232	mscorsvw.exe
1232	mscorsvw.exe
1220	mscorsvw.exe
1220	mscorsvw.exe
688	mscorsvw.exe
688	mscorsvw.exe
2396	mscorsvw.exe
2396	mscorsvw.exe
2176	mscorsvw.exe
2176	mscorsvw.exe
2680	mscorsvw.exe
2680	mscorsvw.exe
2584	mscorsvw.exe
2584	mscorsvw.exe
2936	mscorsvw.exe
2936	mscorsvw.exe
2548	mscorsvw.exe
2548	mscorsvw.exe
1944	mscorsvw.exe
1944	mscorsvw.exe
2696	mscorsvw.exe
2696	mscorsvw.exe
1200	mscorsvw.exe
1200	mscorsvw.exe
2132	mscorsvw.exe
2132	mscorsvw.exe
376	mscorsvw.exe
376	mscorsvw.exe
2948	mscorsvw.exe
2948	mscorsvw.exe
2068	mscorsvw.exe
2068	mscorsvw.exe
832	mscorsvw.exe
832	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3290804112-2823094203-3137964600-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3290804112-2823094203-3137964600-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\I:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\J:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\P:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\H:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\O:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\V:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\W:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\G:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\Z:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\Q:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\L:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\Y:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\K:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\T:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\U:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\X:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\N:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\R:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\M:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\S:	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\ui0detect.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File created	\??\c:\windows\system32\msdtc.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\vssvc.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\vds.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\windows\system32\alg.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Internet Explorer\ielowutil.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\7-Zip\7z.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA267.tmp\Microsoft.Office.Tools.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1C38.tmp\Microsoft.Office.Tools.Common.v9.0.dll	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPCA90.tmp\ehiVidCtl.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9F99.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA573.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA831.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.vir	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe
2908	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1552	JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe
Token: SeShutdownPrivilege	2908	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 484	2908	mscorsvw.exe	36
PID 2908 wrote to memory of 484	2908	mscorsvw.exe	36
PID 2908 wrote to memory of 484	2908	mscorsvw.exe	36
PID 2908 wrote to memory of 2228	2908	mscorsvw.exe	37
PID 2908 wrote to memory of 2228	2908	mscorsvw.exe	37
PID 2908 wrote to memory of 2228	2908	mscorsvw.exe	37
PID 2908 wrote to memory of 1940	2908	mscorsvw.exe	40
PID 2908 wrote to memory of 1940	2908	mscorsvw.exe	40
PID 2908 wrote to memory of 1940	2908	mscorsvw.exe	40
PID 2908 wrote to memory of 2840	2908	mscorsvw.exe	41
PID 2908 wrote to memory of 2840	2908	mscorsvw.exe	41
PID 2908 wrote to memory of 2840	2908	mscorsvw.exe	41
PID 2908 wrote to memory of 2900	2908	mscorsvw.exe	42
PID 2908 wrote to memory of 2900	2908	mscorsvw.exe	42
PID 2908 wrote to memory of 2900	2908	mscorsvw.exe	42
PID 2908 wrote to memory of 2220	2908	mscorsvw.exe	43
PID 2908 wrote to memory of 2220	2908	mscorsvw.exe	43
PID 2908 wrote to memory of 2220	2908	mscorsvw.exe	43
PID 2908 wrote to memory of 2508	2908	mscorsvw.exe	44
PID 2908 wrote to memory of 2508	2908	mscorsvw.exe	44
PID 2908 wrote to memory of 2508	2908	mscorsvw.exe	44
PID 2908 wrote to memory of 1268	2908	mscorsvw.exe	45
PID 2908 wrote to memory of 1268	2908	mscorsvw.exe	45
PID 2908 wrote to memory of 1268	2908	mscorsvw.exe	45
PID 2908 wrote to memory of 1532	2908	mscorsvw.exe	46
PID 2908 wrote to memory of 1532	2908	mscorsvw.exe	46
PID 2908 wrote to memory of 1532	2908	mscorsvw.exe	46
PID 2908 wrote to memory of 2244	2908	mscorsvw.exe	47
PID 2908 wrote to memory of 2244	2908	mscorsvw.exe	47
PID 2908 wrote to memory of 2244	2908	mscorsvw.exe	47
PID 2908 wrote to memory of 628	2908	mscorsvw.exe	48
PID 2908 wrote to memory of 628	2908	mscorsvw.exe	48
PID 2908 wrote to memory of 628	2908	mscorsvw.exe	48
PID 2908 wrote to memory of 2692	2908	mscorsvw.exe	49
PID 2908 wrote to memory of 2692	2908	mscorsvw.exe	49
PID 2908 wrote to memory of 2692	2908	mscorsvw.exe	49
PID 2908 wrote to memory of 2236	2908	mscorsvw.exe	50
PID 2908 wrote to memory of 2236	2908	mscorsvw.exe	50
PID 2908 wrote to memory of 2236	2908	mscorsvw.exe	50
PID 2908 wrote to memory of 2356	2908	mscorsvw.exe	51
PID 2908 wrote to memory of 2356	2908	mscorsvw.exe	51
PID 2908 wrote to memory of 2356	2908	mscorsvw.exe	51
PID 2908 wrote to memory of 2084	2908	mscorsvw.exe	52
PID 2908 wrote to memory of 2084	2908	mscorsvw.exe	52
PID 2908 wrote to memory of 2084	2908	mscorsvw.exe	52
PID 2908 wrote to memory of 2072	2908	mscorsvw.exe	53
PID 2908 wrote to memory of 2072	2908	mscorsvw.exe	53
PID 2908 wrote to memory of 2072	2908	mscorsvw.exe	53
PID 2908 wrote to memory of 2792	2908	mscorsvw.exe	54
PID 2908 wrote to memory of 2792	2908	mscorsvw.exe	54
PID 2908 wrote to memory of 2792	2908	mscorsvw.exe	54
PID 2908 wrote to memory of 2592	2908	mscorsvw.exe	55
PID 2908 wrote to memory of 2592	2908	mscorsvw.exe	55
PID 2908 wrote to memory of 2592	2908	mscorsvw.exe	55
PID 2908 wrote to memory of 1232	2908	mscorsvw.exe	56
PID 2908 wrote to memory of 1232	2908	mscorsvw.exe	56
PID 2908 wrote to memory of 1232	2908	mscorsvw.exe	56
PID 2908 wrote to memory of 388	2908	mscorsvw.exe	57
PID 2908 wrote to memory of 388	2908	mscorsvw.exe	57
PID 2908 wrote to memory of 388	2908	mscorsvw.exe	57
PID 2908 wrote to memory of 1220	2908	mscorsvw.exe	58
PID 2908 wrote to memory of 1220	2908	mscorsvw.exe	58
PID 2908 wrote to memory of 1220	2908	mscorsvw.exe	58
PID 2908 wrote to memory of 2536	2908	mscorsvw.exe	59

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52ec5fefeafaf1ccec560df7ecee6af7.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 218 -InterruptEvent 160 -NGENProcess 214 -Pipe 16c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 1d4 -NGENProcess 150 -Pipe 214 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 258 -NGENProcess 218 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 258 -NGENProcess 1d4 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 244 -NGENProcess 218 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 264 -NGENProcess 220 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 218 -NGENProcess 220 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 218 -InterruptEvent 270 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 264 -NGENProcess 258 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 264 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 274 -NGENProcess 218 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 284 -NGENProcess 150 -Pipe 15c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 150 -NGENProcess 264 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 150 -InterruptEvent 28c -NGENProcess 218 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 218 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 218 -InterruptEvent 294 -NGENProcess 264 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 28c -NGENProcess 264 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 29c -NGENProcess 284 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 264 -Pipe 218 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 264 -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2ac -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2176
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2e4 -NGENProcess 2ac -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2ac -NGENProcess 2d4 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2ec -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2cc -NGENProcess 2e4 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2f4 -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2f0 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2d4 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2f0 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2f0 -NGENProcess 2fc -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2fc -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 310 -NGENProcess 308 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 308 -NGENProcess 2f0 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 318 -NGENProcess 2cc -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 314 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2f0 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2cc -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 314 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2f0 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2cc -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 314 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2f0 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2cc -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 314 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 338 -NGENProcess 2f0 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:1444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 330 -NGENProcess 2cc -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 348 -NGENProcess 220 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:2492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2f0 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:1540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2cc -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 220 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:2396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2f0 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:1372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2cc -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 220 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 2f0 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 2cc -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:3024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 220 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 220 -NGENProcess 364 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:2560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 374 -NGENProcess 2cc -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:1068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 370 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 364 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 2cc -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 370 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:2428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 364 -Pipe 220 -Comment "NGen Worker Process"
  2⤵
  PID:2664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 2cc -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 384 -NGENProcess 394 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 39c -NGENProcess 364 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:1876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 314 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 394 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:1232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 364 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2364
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 314 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 394 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:1120
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 364 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 314 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 394 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:2120
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 364 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b8 -NGENProcess 3c4 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3b0 -NGENProcess 364 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 394 -NGENProcess 3c0 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:1268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3c8 -NGENProcess 314 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 364 -Pipe 110 -Comment "NGen Worker Process"
  2⤵
  PID:1828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3c0 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:2104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 314 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:2636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 364 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:2176
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3c0 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 314 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e0 -NGENProcess 3dc -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3cc -NGENProcess 314 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 314 -NGENProcess 3e4 -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 3f0 -NGENProcess 3dc -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3cc -NGENProcess 3f4 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3e0 -NGENProcess 3dc -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3dc -NGENProcess 3d4 -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3fc -NGENProcess 3f4 -Pipe 1cc -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 404 -NGENProcess 3f8 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 3f8 -NGENProcess 3dc -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 40c -NGENProcess 3f4 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:1660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 418 -NGENProcess 408 -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3fc -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:2500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 3f4 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 408 -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  PID:1412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 3fc -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:1952

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
648KB

MD5
e90aca4d61dcd39d47bd2e60a3c37c49

SHA1
4bde05555000f67b48d5c57d93747216ab28e090

SHA256
438d5fe4b1de492485923b8258acf0446209220c93d223c3130bd0a692017b3e

SHA512
9ac5046f4f0a2f049c35855acdd7e74ef59f230093aab138fe3583a6dcc849671c987088e93f7f26bfde8524e1a274a8d2a8ecdc5dcf471272c6a9298092d225

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.5MB

MD5
f19272be39e08fddcb9514db2aa33a4e

SHA1
395f8c082f12955e4ac9b3a7586f6301d72459b6

SHA256
7f00beed6a8f7fb2c240fcefdc60afbd53a3481c90d911c5cebbd0da08294c04

SHA512
76c63ebe9b7f027a83062eda7acd784695b311fd359c56f13f6443e6e3e9785b03bb439ffe0edf174e8e8c5fdb6e49b4bc647613897be16153031d971e9d66c1

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
4681dc5867acfe8a50cfd679ea3878ee

SHA1
ecab87985c3ca1ab41d063668c0b507d336cb358

SHA256
6a16f8c95ce4a437b32b3f154999bececb52837c377036f2880923718b9dbcbe

SHA512
faaef4e542b95da874cae999604795429141cbab167dff8a5f9037afd2d41215b8faebd2c1c619cdb5e645a5dab03e7b817c143437e58dd6425e71c21b52b4e3

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.2MB

MD5
01101d1a2532a68c96a4dc5148005a2b

SHA1
ed0799ef14ae6446a607c2d650566c9569925d01

SHA256
66162442aba7d73e7eb764a589b19343196a69d0813dcf3ac932a6e82c9539d8

SHA512
19afecd4b01ddd7d7219e6cfed671c6bdb1fa0b74cdee316d53c3211ec0c67fd0e4e2ee2bda0a58767cff23af1591cb5aae86ad654ea0628a48ce16589fa5ec5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
590KB

MD5
bd225b3c7fa7fc77bd5e0ec7332c1036

SHA1
5160a72f191bdb0b7efc941f0b4206185c33a1a2

SHA256
ba9a5c4c7521d5b04e7037f300eb8b14880b34dcb2ab8d3651c1e168105e600d

SHA512
6f8f209b9162d5ae52750e2893e5a86728099a78fb970a299a37ca663878df4e767b626b7fc2f52befa67c8f07c8ba3d6f985ab837569a49c62d3e6793376f18

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
9e9634f7975be5849b5a88e074cf072a

SHA1
7168f916b09c8c53731ceeb94e295610c42ca267

SHA256
b94790d27b921b0492e3ad8543d28a9ef496f668878fe22f1b640cd1bfb0f579

SHA512
a62ca082db478a836131ca58604d0877535be9e15ba9bb24141212c8850350a988c26bd4fd8253f8f101a1bf578ff32dd2a632e312b15072974a01ea7c5787ff

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
caf6986a5c0e09eba873e4ce474e4ac6

SHA1
37d4fb3bbbcc52e9bff266bef0efdba8f8ff020d

SHA256
983e71d8d9b7fe961935941c632a8f93c3881e3d8243203600bd4cff62b4d716

SHA512
beab2f9b9d6f5490fe8b9de46eec39c3a59f6ae8682bea49102f93289093b7fecde5eb0a746ae767d695f3beb15732577b174d36f767e8eebbd551d132b62965

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
567KB

MD5
0e775a614044e5da70c70f18e132fab7

SHA1
6653b9b1fdcf0dbac5c9bb56315bce74d2cea67b

SHA256
2f6ccc18b40924240366c7eea421774cce9bd68e4119e31b30072cc93f295c04

SHA512
9b188a4376d48b65e5a293f62f6ec1fe9c0a4ff4ad0bbc982008e1d7e0315ab7f2f18d74448f083680b238d6f922f6ca9fd69700df009a712966884c9754a7ad

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
a0b1abeadfd7a21b92a005427f33cd2e

SHA1
e8df0e2c307ddfdafed9369b276c7e7a50bc028c

SHA256
ad4f0ecbec91dd66d8f3ec837dfb63a466bbdadfe4762848cd73a041f8bf68ad

SHA512
a9aeab9f5f05f5c611e6a51e15305c163b9e01f1f289e62737f6ad7858d5033f7da4a0b471328914d5b9988709e053b539d109d988fe9a836f2d2220f0ca04db

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
598KB

MD5
6ba455b96743c970db5be333c4d73e10

SHA1
a63005c0436d7030c2e2203c80dbfd1ce59736ca

SHA256
ba51861dfa63fe448a10fb0a35512ef3a0f72f83dcb845d796dbd7fe11c05025

SHA512
448651072196b047525d1f6105abe3f6026444e29d3217119ec18a23f8a6ad8c76cf817daac2039b6ea1f0b2eec7ec7f33795653ec5a8ab4ebe7c318e4dbb05d

Download Submit
C:\Windows\Temp\Cab1AB2.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar1CB6.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\176ce549fd8cdb877b5925f392bbefd7\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
3ab657543b015280d98f87cc9f7e741c

SHA1
9a8aa76554bb56c13134ca57dfc37f785398fff2

SHA256
d82495f677611dd2b27c3fba040d391fee3539766248ef925c9e874cc4c2adeb

SHA512
03254c053a83c9a24dec64500b665029bb8ce6f3ed9d9098529357327435129b0d612633bad60b5eaea3c68ae7f7dc1fe8f4aa85dc88a85e200406405c5010cc

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2b30de3c52dbdb36eb4e76d697e709a9\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
ab12db03ebb8d6fc3b1191e1b1c8cd88

SHA1
3e39c4c2a3b0d2121804a3df20e6361cda0df4e7

SHA256
acdb2f9fa7f920ab8a81875261188bf1a7107a4c6629c2b4609050bafe9ad949

SHA512
8dffdc74caf32ebdcd0100e749ddaae7378f8d5fd7c9627ff9869f074f2527562b78b6edc45f922aae6605c8ef65da36d92beed184435bf994d7fb1082b6cd1a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9427a7767d175004b17b6714f7fc9f7d\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
5b905b040d701e4af1c7766452bc5e39

SHA1
f358381adf58431bd3cd06fc25e9699abb1c5af7

SHA256
a78732f5c26baabd7ec3f4f1938faf1f16402cd4d98f8c08720664c958a390d8

SHA512
56e10d355cab16c3beda38fa3b32e3c3d550383256092e47cf3c0b488b0a167d135ded3e7030a23a517aab889c0d59c1503985d9dd6bdbea508d9bcc3654009d

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\f36d26700f86c84bcf7cd0b3ae6dcaa3\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
7da34ea1b2ebbcde6abad7576c74037e

SHA1
fef759604fce3258d9eb7bd13a7b4b0aa49d1b8e

SHA256
60c5840bd85a6765237666830e374b73c8bf7c17f7d1580be8598b95a576da64

SHA512
8b6810cc61ec3dd022f48f10962f1d1c3136f8bf3c70ba3d1818a7f597b2bd1ce42523a0e8e2a70544958491c9a0626b289e187aa4285772e343c29497772167

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
648KB

MD5
825f6d3f2b7b1402574eec45cb63aa1d

SHA1
45d2c6c2fed4e8faa424be8bf0331eba71aacd97

SHA256
2b0469087fa010d953d19020f4aec5683451ab2ea66c4462ea6062cb566057ce

SHA512
260c74fa4b70f4bd915decee19d85c7aaec5c740b117782c073a8ad7dc55fb5bc17b731557bb93555f7a8f6b2e7734917ae28607c7e94be76fe070f36ed6c466

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
723KB

MD5
14d9a88cdf038256240a007703b2f38f

SHA1
56334b5422173b5ec635376aa9fc710bba708264

SHA256
e6432a6e551a5ab64114e1a10015cf2a29bba9d74a51030af4a1555561b0b1f1

SHA512
87714acafa48b06a30cb097111257b0de3128319a3b2850a05f56f177e9d9430511fbaf3a7b272975848070c07aa1c399ef19856f1644a449c093eeb86c95002

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
632KB

MD5
440bbb339024da46c396e30ccb8a7f85

SHA1
62928cc24778ed525ba45610e2e8227edc22d98e

SHA256
03428384a22756df1f0252e706d3f7a45383e322e29415716ca4957b60a5d8f8

SHA512
ccd5fb2bf6aec716ec9798f2aefb3b02d1c2f34b0717a6a8f2fdbfac11311a35f63cbddda99b7043e6bfec9f932b7bedecb570d97e8839949299ad0f3972d462

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
544KB

MD5
4f89ec9984e7dd8b8362581377627e0c

SHA1
02f11d2b56e50cb19f1a09244d778cd0fe3b017a

SHA256
1be795db7f2d3dcd9e596f4831a2bfcd4d59f06df41308ffa012c7bb4006109d

SHA512
fe1507eedc2689e6c419ebe47deade605604b4c18fa59f78780751b23a217cd67a55bbdd13b06f3bf32dc5d6832a5d9302bd0484cb404306abb6a0820d3fe8b1

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
585KB

MD5
1a305f343fab7c806f6e6eece71e510a

SHA1
77e73b06f0426a92059bc5ea0a46f60a92655832

SHA256
a022d1e8711cb8fb1ebdb8784ac2e3a4b154f3208fb2435b431e6b03c86d6eb1

SHA512
93fe1cc55e36bd24266b8a0703d1032a37c4a13a1ae48443e8d5b7705f9a065acb4c695a767d2a8f45c71a9abb94191ea1b6b26651c5be03d64c7b0f4fb0e0d6

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
554be4b55fc54cecbb73da8c0b289594

SHA1
143cc0a3d502b303e3ecc9dfcc309b45df570550

SHA256
e1ea7a65474f6e4569d46f13cc2b3313030d80d2e5558a0b62c8982e92eed0e8

SHA512
05acabb42568f1c7a91fa4e487ecbe55e92a27c5163f1afab5599ec37f5fc70e6ac52dd2cd3d4762c9f30a007e731dc16e28c2d02f21be2f83ca1940e0d53ffb

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
13cc51dca39834d06ab600aa403a973d

SHA1
db420ae777cef2f20e0f60f6d0e40bcddbc9c7dc

SHA256
138e2ffd2276d1b42dc64d3fe83295ac1dae86479eb480353454e2720480b5b8

SHA512
f36dcf8c2766798571e2774f3809a5bd68fc903faa6f5170177a3afde6f1d9e7516e070a70d76989ac94b2010855290f062482285a9b02be8e7a458d3733fdc7

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
c86d577d95049949d11d7fa544f2eaff

SHA1
b1dd89a3576fd1be76ab7c5b307a51bb2de90d11

SHA256
9745a1fd7c95533437f124782c006019c347797c06d47ad7c283e0a12b36caec

SHA512
988f8bcd35c4d83ca76c5a765420ecc31ffd93dcc4d2491bce933ad2cb1fa5eefdd98427ca75717f4d9835ec19c0aa83c81da732eca4fb6e8a68ec032c3596fb

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
617KB

MD5
b67f32640c1d14b97e215cf8563075ef

SHA1
4a2ebcb28315bd6e69f918a1381e8b34e7262fdf

SHA256
10fb246d4a1c5647df8f9562d4033024e4881506e258c91e37735959c02495d8

SHA512
1fe67714f306a3e50d492218f8f4f75d48d548aec38d6902e0223beb51e9b03afbe6d6db478ef64d24c1bf79b3fde10734ddf782ce85db55d5b004b4fa3567c6

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP951E.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP982A.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9C11.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9F99.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA267.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA573.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA831.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPAAEF.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
memory/388-457-0x0000000002F30000-0x0000000002F3A000-memory.dmp

Filesize
40KB

Download
memory/484-94-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/484-135-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/628-368-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/628-363-0x000000001C540000-0x000000001C550000-memory.dmp

Filesize
64KB

Download
memory/628-378-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/628-367-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/628-359-0x00000000030B0000-0x00000000030BC000-memory.dmp

Filesize
48KB

Download
memory/628-360-0x0000000003140000-0x000000000314E000-memory.dmp

Filesize
56KB

Download
memory/628-361-0x000000001C4B0000-0x000000001C4C6000-memory.dmp

Filesize
88KB

Download
memory/628-362-0x000000001C4D0000-0x000000001C518000-memory.dmp

Filesize
288KB

Download
memory/1232-456-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1268-327-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1268-319-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1268-321-0x00000000005C0000-0x00000000005D8000-memory.dmp

Filesize
96KB

Download
memory/1268-325-0x000000001C550000-0x000000001C56E000-memory.dmp

Filesize
120KB

Download
memory/1268-324-0x000000001C530000-0x000000001C54A000-memory.dmp

Filesize
104KB

Download
memory/1268-323-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/1316-100-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/1316-82-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/1532-329-0x00000000006C0000-0x00000000006D8000-memory.dmp

Filesize
96KB

Download
memory/1532-342-0x000000001D1C0000-0x000000001D1D8000-memory.dmp

Filesize
96KB

Download
memory/1532-332-0x0000000000890000-0x00000000008D8000-memory.dmp

Filesize
288KB

Download
memory/1532-331-0x0000000000740000-0x000000000074E000-memory.dmp

Filesize
56KB

Download
memory/1532-330-0x0000000000730000-0x000000000073C000-memory.dmp

Filesize
48KB

Download
memory/1532-352-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1532-334-0x0000000003070000-0x000000000308E000-memory.dmp

Filesize
120KB

Download
memory/1532-333-0x0000000003050000-0x000000000306A000-memory.dmp

Filesize
104KB

Download
memory/1532-341-0x000000001D1C0000-0x000000001D1D8000-memory.dmp

Filesize
96KB

Download
memory/1552-1-0x0000000001002000-0x0000000001003000-memory.dmp

Filesize
4KB

Download
memory/1552-2-0x0000000001000000-0x000000000119E000-memory.dmp

Filesize
1.6MB

Download
memory/1552-0-0x0000000001000000-0x000000000119E000-memory.dmp

Filesize
1.6MB

Download
memory/1940-281-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1940-274-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2072-426-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2072-424-0x0000000000790000-0x000000000079E000-memory.dmp

Filesize
56KB

Download
memory/2072-423-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2084-409-0x0000000002F60000-0x0000000002F76000-memory.dmp

Filesize
88KB

Download
memory/2084-413-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/2084-408-0x0000000000730000-0x000000000074A000-memory.dmp

Filesize
104KB

Download
memory/2084-422-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2220-289-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2220-300-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2220-297-0x0000000002FD0000-0x0000000003018000-memory.dmp

Filesize
288KB

Download
memory/2220-298-0x0000000000820000-0x0000000000836000-memory.dmp

Filesize
88KB

Download
memory/2220-296-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/2220-295-0x00000000007C0000-0x00000000007CE000-memory.dmp

Filesize
56KB

Download
memory/2228-164-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2228-130-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2236-392-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2236-387-0x00000000008B0000-0x00000000008C4000-memory.dmp

Filesize
80KB

Download
memory/2236-386-0x0000000000840000-0x000000000084C000-memory.dmp

Filesize
48KB

Download
memory/2236-385-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2236-382-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2236-391-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2236-402-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2244-351-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2244-353-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2244-355-0x00000000031B0000-0x00000000031C0000-memory.dmp

Filesize
64KB

Download
memory/2244-357-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2324-89-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2324-128-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2324-203-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2356-406-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2356-404-0x00000000006C0000-0x00000000006D6000-memory.dmp

Filesize
88KB

Download
memory/2356-403-0x00000000006A0000-0x00000000006BA000-memory.dmp

Filesize
104KB

Download
memory/2356-401-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2508-303-0x0000000003060000-0x000000000306C000-memory.dmp

Filesize
48KB

Download
memory/2508-302-0x00000000007C0000-0x00000000007CE000-memory.dmp

Filesize
56KB

Download
memory/2508-320-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2508-309-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2508-310-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2508-304-0x000000001C480000-0x000000001C4C8000-memory.dmp

Filesize
288KB

Download
memory/2508-305-0x000000001C4D0000-0x000000001C4E6000-memory.dmp

Filesize
88KB

Download
memory/2592-440-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2592-443-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2664-35-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2664-37-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2664-63-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2668-54-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/2668-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2668-21-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/2692-379-0x00000000031C0000-0x00000000031CC000-memory.dmp

Filesize
48KB

Download
memory/2692-377-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2692-383-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2692-380-0x000000001C530000-0x000000001C544000-memory.dmp

Filesize
80KB

Download
memory/2792-428-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/2792-441-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2792-432-0x0000000000850000-0x000000000085E000-memory.dmp

Filesize
56KB

Download
memory/2832-46-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2840-280-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2840-287-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2900-290-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2908-92-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2908-57-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2908-58-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download