expiro | 4b6aae8706e38f99b693eb04f2324431e0606a80fb5740bae2dbf2a57083f63f

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/01/2025, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
Size

536KB
MD5

620efd5bbd4b9775f3fcdd716f866330
SHA1

32c6c2a9098a3458b30ba9b9afb7905a5a82a182
SHA256

4b6aae8706e38f99b693eb04f2324431e0606a80fb5740bae2dbf2a57083f63f
SHA512

3b8cc5c7397003c331941b34debdc2697a3973d3902007f712f5aea5c0127bde7fdb3bed4a51a49f1bdc024cf0bcf3fd4e7779ce7c5a9064832524e9ed067595
SSDEEP

6144:81LbedrXB7DpNIV711Y3oiMxCZMMCSithEtU/VRl04yoAMKQUrM6w1OtnmJg6nYt:ULgrXtTs1+dYSBtOl92KEZmC6Sw9vub

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2100-2-0x0000000001000000-0x00000000011A2000-memory.dmp	family_expiro1
behavioral1/memory/536-54-0x0000000010000000-0x00000000101A9000-memory.dmp	family_expiro1

Executes dropped EXE 64 IoCs

pid	Process
536	mscorsvw.exe
476	Process not Found
2800	mscorsvw.exe
2832	mscorsvw.exe
2904	mscorsvw.exe
2872	elevation_service.exe
1600	IEEtwCollector.exe
1168	mscorsvw.exe
484	mscorsvw.exe
2136	mscorsvw.exe
1620	mscorsvw.exe
2152	mscorsvw.exe
2444	mscorsvw.exe
2076	mscorsvw.exe
1168	mscorsvw.exe
3000	mscorsvw.exe
1000	mscorsvw.exe
1916	mscorsvw.exe
2404	mscorsvw.exe
2188	mscorsvw.exe
940	mscorsvw.exe
1552	mscorsvw.exe
2604	mscorsvw.exe
2464	mscorsvw.exe
1484	mscorsvw.exe
2848	mscorsvw.exe
1648	mscorsvw.exe
2996	mscorsvw.exe
2572	mscorsvw.exe
1332	mscorsvw.exe
1604	mscorsvw.exe
960	mscorsvw.exe
644	mscorsvw.exe
2516	mscorsvw.exe
1628	mscorsvw.exe
1564	mscorsvw.exe
1300	mscorsvw.exe
2880	mscorsvw.exe
2628	mscorsvw.exe
2200	mscorsvw.exe
580	mscorsvw.exe
1144	mscorsvw.exe
2984	mscorsvw.exe
1892	mscorsvw.exe
2076	mscorsvw.exe
1268	mscorsvw.exe
900	mscorsvw.exe
1588	mscorsvw.exe
2344	mscorsvw.exe
2920	mscorsvw.exe
1864	mscorsvw.exe
2704	mscorsvw.exe
1420	mscorsvw.exe
2936	mscorsvw.exe
2620	mscorsvw.exe
2752	mscorsvw.exe
2332	mscorsvw.exe
2892	mscorsvw.exe
2424	mscorsvw.exe
1616	mscorsvw.exe
340	mscorsvw.exe
604	mscorsvw.exe
2968	mscorsvw.exe
1560	mscorsvw.exe

Loads dropped DLL 52 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
2076	mscorsvw.exe
2076	mscorsvw.exe
3000	mscorsvw.exe
3000	mscorsvw.exe
1916	mscorsvw.exe
1916	mscorsvw.exe
2188	mscorsvw.exe
2188	mscorsvw.exe
1552	mscorsvw.exe
1552	mscorsvw.exe
2464	mscorsvw.exe
2464	mscorsvw.exe
2848	mscorsvw.exe
2848	mscorsvw.exe
2996	mscorsvw.exe
2996	mscorsvw.exe
1332	mscorsvw.exe
1332	mscorsvw.exe
960	mscorsvw.exe
960	mscorsvw.exe
2516	mscorsvw.exe
2516	mscorsvw.exe
1564	mscorsvw.exe
1564	mscorsvw.exe
2880	mscorsvw.exe
2880	mscorsvw.exe
2200	mscorsvw.exe
2200	mscorsvw.exe
1144	mscorsvw.exe
1144	mscorsvw.exe
1892	mscorsvw.exe
1892	mscorsvw.exe
2920	mscorsvw.exe
2920	mscorsvw.exe
1864	mscorsvw.exe
1864	mscorsvw.exe
1420	mscorsvw.exe
1420	mscorsvw.exe
2344	mscorsvw.exe
2344	mscorsvw.exe
3040	mscorsvw.exe
3040	mscorsvw.exe
320	mscorsvw.exe
320	mscorsvw.exe
2948	mscorsvw.exe
2948	mscorsvw.exe
2472	mscorsvw.exe
2472	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3551809350-4263495960-1443967649-1000	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3551809350-4263495960-1443967649-1000\EnableNotifications = "0"	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\V:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\I:	elevation_service.exe
File opened (read-only)	\??\U:	elevation_service.exe
File opened (read-only)	\??\E:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\X:	elevation_service.exe
File opened (read-only)	\??\K:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\N:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\Y:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\Z:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\E:	elevation_service.exe
File opened (read-only)	\??\J:	elevation_service.exe
File opened (read-only)	\??\T:	elevation_service.exe
File opened (read-only)	\??\O:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\S:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\V:	elevation_service.exe
File opened (read-only)	\??\J:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\P:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\X:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\O:	elevation_service.exe
File opened (read-only)	\??\P:	elevation_service.exe
File opened (read-only)	\??\Q:	elevation_service.exe
File opened (read-only)	\??\H:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\M:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\H:	elevation_service.exe
File opened (read-only)	\??\Y:	elevation_service.exe
File opened (read-only)	\??\G:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\K:	elevation_service.exe
File opened (read-only)	\??\S:	elevation_service.exe
File opened (read-only)	\??\I:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\R:	elevation_service.exe
File opened (read-only)	\??\Z:	elevation_service.exe
File opened (read-only)	\??\L:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\Q:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\T:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\L:	elevation_service.exe
File opened (read-only)	\??\M:	elevation_service.exe
File opened (read-only)	\??\N:	elevation_service.exe
File opened (read-only)	\??\W:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened (read-only)	\??\G:	elevation_service.exe
File opened (read-only)	\??\W:	elevation_service.exe
File opened (read-only)	\??\R:	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\msdtc.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\ui0detect.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\alg.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	elevation_service.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\locator.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	elevation_service.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\vssvc.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\vds.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	elevation_service.exe
File created	\??\c:\windows\system32\alg.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\7-Zip\7zFM.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\DVD Maker\DVDMaker.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Internet Explorer\iexplore.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\7-Zip\7z.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Internet Explorer\ieinstal.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	elevation_service.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE012.tmp\Microsoft.Office.Tools.Common.v9.0.dll	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	elevation_service.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6C0C.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7935.tmp\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP69AB.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	elevation_service.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP738B.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2100	JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2872	elevation_service.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe
Token: SeShutdownPrivilege	2904	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1168	2904	mscorsvw.exe	37
PID 2904 wrote to memory of 1168	2904	mscorsvw.exe	37
PID 2904 wrote to memory of 1168	2904	mscorsvw.exe	37
PID 2904 wrote to memory of 484	2904	mscorsvw.exe	39
PID 2904 wrote to memory of 484	2904	mscorsvw.exe	39
PID 2904 wrote to memory of 484	2904	mscorsvw.exe	39
PID 2904 wrote to memory of 2136	2904	mscorsvw.exe	40
PID 2904 wrote to memory of 2136	2904	mscorsvw.exe	40
PID 2904 wrote to memory of 2136	2904	mscorsvw.exe	40
PID 2904 wrote to memory of 1620	2904	mscorsvw.exe	41
PID 2904 wrote to memory of 1620	2904	mscorsvw.exe	41
PID 2904 wrote to memory of 1620	2904	mscorsvw.exe	41
PID 2904 wrote to memory of 2152	2904	mscorsvw.exe	42
PID 2904 wrote to memory of 2152	2904	mscorsvw.exe	42
PID 2904 wrote to memory of 2152	2904	mscorsvw.exe	42
PID 2904 wrote to memory of 2444	2904	mscorsvw.exe	43
PID 2904 wrote to memory of 2444	2904	mscorsvw.exe	43
PID 2904 wrote to memory of 2444	2904	mscorsvw.exe	43
PID 2904 wrote to memory of 2076	2904	mscorsvw.exe	44
PID 2904 wrote to memory of 2076	2904	mscorsvw.exe	44
PID 2904 wrote to memory of 2076	2904	mscorsvw.exe	44
PID 2904 wrote to memory of 1168	2904	mscorsvw.exe	45
PID 2904 wrote to memory of 1168	2904	mscorsvw.exe	45
PID 2904 wrote to memory of 1168	2904	mscorsvw.exe	45
PID 2904 wrote to memory of 3000	2904	mscorsvw.exe	46
PID 2904 wrote to memory of 3000	2904	mscorsvw.exe	46
PID 2904 wrote to memory of 3000	2904	mscorsvw.exe	46
PID 2904 wrote to memory of 1000	2904	mscorsvw.exe	47
PID 2904 wrote to memory of 1000	2904	mscorsvw.exe	47
PID 2904 wrote to memory of 1000	2904	mscorsvw.exe	47
PID 2904 wrote to memory of 1916	2904	mscorsvw.exe	48
PID 2904 wrote to memory of 1916	2904	mscorsvw.exe	48
PID 2904 wrote to memory of 1916	2904	mscorsvw.exe	48
PID 2904 wrote to memory of 2404	2904	mscorsvw.exe	49
PID 2904 wrote to memory of 2404	2904	mscorsvw.exe	49
PID 2904 wrote to memory of 2404	2904	mscorsvw.exe	49
PID 2904 wrote to memory of 2188	2904	mscorsvw.exe	50
PID 2904 wrote to memory of 2188	2904	mscorsvw.exe	50
PID 2904 wrote to memory of 2188	2904	mscorsvw.exe	50
PID 2904 wrote to memory of 940	2904	mscorsvw.exe	51
PID 2904 wrote to memory of 940	2904	mscorsvw.exe	51
PID 2904 wrote to memory of 940	2904	mscorsvw.exe	51
PID 2904 wrote to memory of 1552	2904	mscorsvw.exe	52
PID 2904 wrote to memory of 1552	2904	mscorsvw.exe	52
PID 2904 wrote to memory of 1552	2904	mscorsvw.exe	52
PID 2904 wrote to memory of 2604	2904	mscorsvw.exe	53
PID 2904 wrote to memory of 2604	2904	mscorsvw.exe	53
PID 2904 wrote to memory of 2604	2904	mscorsvw.exe	53
PID 2904 wrote to memory of 2464	2904	mscorsvw.exe	54
PID 2904 wrote to memory of 2464	2904	mscorsvw.exe	54
PID 2904 wrote to memory of 2464	2904	mscorsvw.exe	54
PID 2904 wrote to memory of 1484	2904	mscorsvw.exe	55
PID 2904 wrote to memory of 1484	2904	mscorsvw.exe	55
PID 2904 wrote to memory of 1484	2904	mscorsvw.exe	55
PID 2904 wrote to memory of 2848	2904	mscorsvw.exe	56
PID 2904 wrote to memory of 2848	2904	mscorsvw.exe	56
PID 2904 wrote to memory of 2848	2904	mscorsvw.exe	56
PID 2904 wrote to memory of 1648	2904	mscorsvw.exe	57
PID 2904 wrote to memory of 1648	2904	mscorsvw.exe	57
PID 2904 wrote to memory of 1648	2904	mscorsvw.exe	57
PID 2904 wrote to memory of 2996	2904	mscorsvw.exe	58
PID 2904 wrote to memory of 2996	2904	mscorsvw.exe	58
PID 2904 wrote to memory of 2996	2904	mscorsvw.exe	58
PID 2904 wrote to memory of 2572	2904	mscorsvw.exe	59

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_620efd5bbd4b9775f3fcdd716f866330.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 164 -NGENProcess 168 -Pipe 174 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 164 -NGENProcess 168 -Pipe 178 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 160 -InterruptEvent 1d8 -NGENProcess 1bc -Pipe 154 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 22c -NGENProcess 224 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 230 -NGENProcess 180 -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 234 -NGENProcess 1bc -Pipe 1fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 238 -NGENProcess 224 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 1bc -NGENProcess 224 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 244 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:3000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 238 -NGENProcess 24c -Pipe 1bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 230 -NGENProcess 23c -Pipe 180 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 23c -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 248 -NGENProcess 24c -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 24c -NGENProcess 1d8 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 25c -NGENProcess 230 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 230 -NGENProcess 248 -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 238 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 268 -NGENProcess 1d8 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 268 -NGENProcess 238 -Pipe 230 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 238 -NGENProcess 264 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 274 -NGENProcess 160 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 160 -NGENProcess 268 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 160 -InterruptEvent 27c -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 264 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 284 -NGENProcess 268 -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 268 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 28c -NGENProcess 274 -Pipe 160 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 27c -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c0 -NGENProcess 2b8 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2c8 -NGENProcess 2a4 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2cc -NGENProcess 2b8 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b8 -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2c4 -NGENProcess 29c -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2d8 -NGENProcess 2d0 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2e0 -NGENProcess 29c -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2e4 -NGENProcess 2dc -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 2b8 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 29c -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2dc -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2b8 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 29c -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2dc -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2b8 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 29c -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2dc -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:1696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2b8 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 29c -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2dc -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:3020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2b8 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 29c -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2dc -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2b8 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:2540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 29c -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 320 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 314 -NGENProcess 29c -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:1756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 334 -NGENProcess 324 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 320 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 320 -NGENProcess 314 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 340 -NGENProcess 324 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:2264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 33c -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 314 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 324 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:2960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 33c -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 314 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:1400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 324 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 33c -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 314 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:1552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 324 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 33c -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:1868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 314 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 324 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 33c -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 314 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 324 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 33c -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 314 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:1216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 324 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 33c -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:2952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 314 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:2092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 324 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:2924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 33c -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 314 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:1492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 324 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 33c -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 314 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 324 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 33c -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3a4 -NGENProcess 314 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 314 -NGENProcess 3ac -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 3bc -NGENProcess 33c -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3a4 -NGENProcess 3c0 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2240
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3b0 -NGENProcess 33c -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 33c -NGENProcess 3a8 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 3c8 -NGENProcess 3c0 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3c4 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3c4 -NGENProcess 33c -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3d4 -NGENProcess 3c0 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3d0 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 33c -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 3c0 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:2116

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

Filesize
648KB

MD5
b003e002c18d3497215682285f094b7d

SHA1
4073816f2529252d2f08a98c27d2f92727401522

SHA256
d30bd0b1f425f096a42de3e7a82c192ed4d9c9a9386a7f99d69efd211034a45f

SHA512
396e5a013d46217d0632daf379803f3d00fbcdd7c5334136e9ac81cf13c19cf1872b154f97f82fc7bef4972ac2860941671642b9610bc1ff1811a35dc5f6ef59

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.5MB

MD5
321c49b10f53bd1fef5e3e3c5d9c23b0

SHA1
aab0d43c836fed2efda83f6bbbdf6a0b41d88272

SHA256
790303fcb6ef331d02cf2f74b84b1f15282ef13760d9209b5910058e4b2bd7a6

SHA512
b130bf2f1c1e4c01c8b6b2d93d6371a15e409095430664fd7cfb86d0ff8aea532e30989c460814023520eff1532b59c64afa942c44599376273b8b8cfa23b2ca

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
9acf22ea71f5fa69b12ab6ea51c8af56

SHA1
bf028787d809e457705c23f76d07c4038226fa61

SHA256
dae2614f92a310fe63c17abddd5a1bf329590754c00f7bd64626013fc921ada3

SHA512
70f5ba3fb8d8b1989a23197936af668e143a4876a59b8f25b339515e8241a4a57f851621e3e00635ec003d7fc4f99be38ea03bb3a55a909b7e6ed4b56047fcdc

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
44750c6756f2fe57ea8850d2d04ff22d

SHA1
eb2c76e8e326cfa6720aa75d9a5e97880a00d96b

SHA256
aa68c8e02f57721e2e4c25a87633408811daebbe137c5f3451c3f767e414c0d2

SHA512
0c782f9c96d90ed59b40b7916c29c695e84c111c0ddcbf3e6ad6663206121256390eff0407edbdcee2829dafe869cb3a77b0e701f75990b40da49dda6dc35def

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.2MB

MD5
6bc7b86ab708ad525bd07117ccc5a5bd

SHA1
2060800a7c3c79e78e8b73d7ff65d94e0bebe39a

SHA256
cded7744da66ec7983fdebde8c8029aea9355fab2b07cfb50981a2ef954ceb9d

SHA512
b9290f26ee362f9f5f70779d9dd65c2329f7a014ed5aa16ad3b08e5ea4949b853c64ca9b6f411fc7140e83c0e2a96499375b417fee544df73a5f538b24c6a4e0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
590KB

MD5
2f17f2a984001edf90854d93e8402884

SHA1
94c447a3a3b9b4419b12d0077f3a27140f5ba851

SHA256
7d5897ef8ee423dff132ab4e53ee67b57a5b38a4e0258ca87de220a4530761a5

SHA512
4585bf3689d41a10acc60861ea5d9053fc253b52144509f6b9ed5ce5735038ee4171b5e92dff8d2834a08414aedbdc374ceed5e9e5418c08a177fb346a5a7306

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
95e1c6fa3ba5471e871e32cc811c7c61

SHA1
58ce9091b3b220eb052f1c33ed4d428e9a1900ad

SHA256
8956285c841beb4fa795f1422ec08033a186ddeeb5c9cc2cf2bdf56c29fc279f

SHA512
26e7b2fc5dd9c415cb86c120e9fb287461337cc6ea3a288a97ad7f74d9761d2676080819d3ccfd04a221ca7e3a533dfe3ab0125f64e6ba7bc2c1817fc03dfca8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
278d6ebadae92f1fa1bcc0de1cf01676

SHA1
ee61cc18c9f176eeaa9ce95bb6568c28d0cc6c90

SHA256
f9e298f7a153375ac590cc8e4798705ea9317e19b11dffae381b7aaa18434c31

SHA512
2015f8afd0d7003130f5594f76c7bf3e11ae1ea5612591f66d2c199aac020992a9a7ad64189f05b98d239cb7e764c4f302627e8d2054f975f5f0c0e6f05a3d88

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
567KB

MD5
f2788b70c75000d8db4f5edbe4e6e685

SHA1
bb54c7ae7aee921131942cbeeaaced812795094a

SHA256
80cd70a28fa9a8039e867274ab098d5ee43bd93ee0603e520667d4ee072055c2

SHA512
0e6c119e7b0170c7b893539da57bd0e0595fc4138962196fde336ad7095e7a60367f705d653e5301d556b456d496580dc978fbef158fe7bd9e83d4e864a6832b

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
daa02abb47efb6d57d764ec8de3801f5

SHA1
b9c9a0ce1c7d7e9aec7e20496030e1fd7616c35c

SHA256
35a1a678cb5cf687d0cad766621971886cdb2e6674f25638c23ab1d569c7607e

SHA512
69aa32b8c760ba7ce63b121bfc44f3ffc3783fac97baf6d62df47108de45af45567ee0c7767e0552149d79e67e2f86e29fcf7c25da18601bb2d04cdc8cc9097d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
598KB

MD5
8f256e0323f5e3ea61c3ff10efb0fef6

SHA1
369712a526b007270afa593ccd87e367ab838c36

SHA256
63038103bf7c489b0410979e93af235395a6ccaf23c636c69c7508dc9df6d1ab

SHA512
7c6fea99928d76b18e68f5dba73d5253d8571b182bc53701661f095c610eb5e8bb0186c06b3f1be291bf0d0e808873fc7125275bf7eb059e1f2ebd610697e241

Download Submit
C:\Windows\Temp\CabDE5E.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarE0D0.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4cfa15aac4b8284032046a4a02d04683\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
41d6ed0300d69fd98b68f72af892dced

SHA1
55b56cc03e369d29419aa0217a6ecf18ba1488ec

SHA256
0fee17424385c03ecf93274b0b0fe43e4f07e384bb5812bee16a8c159902267b

SHA512
b220551d490345e516b3df952d1a87a473033f60c23a4dc4fbb6f2b0e761f3af0e4daccdbd41715fd7319d08de344d0d930c6b81ee95a623c0f27c1cf3e2dc1c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\5f209b11ba40d80f8af9dd15aa8573d6\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
3a2acd9132bc4cd8d3fd5d4f80c06c5f

SHA1
33e76ee115430a449c997399beac91d620c8a70a

SHA256
8b5006f09e558ed85b8c08c1889666951c9616d19db5f36731b406c6dc030063

SHA512
d52dd4c48fb3f5b6437e27dc8250778dc7788a53dccd3c4306cce038d342cebb2bf3847188ff85afe6e2aeab00f858783cf75364eaad4f2648fbddf3482c4c96

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\73e6a4cba5e11c98d65f01f7880c3f76\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
8d5ddeb9c44353ea35cde6207f2f44e4

SHA1
19441af26a702d74d4e458c20f1750c47f784c71

SHA256
2e7b2761d6815dd1fb36d8ea677b1ab438584a961c27b0641d209457af13e2d7

SHA512
702d1bedd49bd8d46bb39933599c0ea0bc9b661aa397a94c53d648f1b278444c04f06602d2bae99ef229e1b036851f811f3eb7b3ef30c3a2f56461e7fa9fef49

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\cc06edac57c8666a60753e47d06d0b97\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
09e5cfd149a85f69fb9f5648669916e5

SHA1
1791e2a9f1684de584d668be24f60ab166735d23

SHA256
80d6b066fa595e2e00fdf679f68e635e8da52c135f2520642fedc1353d7b9f9d

SHA512
7e03f0f0f93d156adc006984efae6ad400931b4d49113164731cb7b814c2d22036b3af87dcd97d42ef5072a486d27cf06a6dd832ffa3af4814e7e5a282395b48

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
648KB

MD5
51e2e7605ae480d1740278e9ce773726

SHA1
0cb94fadc5d315c9e76e0c98863f79a682d558d5

SHA256
07eaae6af97b716db4e7221229f86a8e6155acc49c89cdc5f86db7bb2d9851e7

SHA512
4714ee7b92be0c5812bc4354840c1d68bc5e770b513d6570cd3b8fa46abebd3469c8c03335f29b191b12f768da3f992a5b61c7a9d4212614645bc08e0943d000

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.0MB

MD5
39c301771e66675734350b176b2dda9e

SHA1
9b55461b73a6f7917f79272ebedcc8915bc39fa4

SHA256
c46ecca29348cc71068bd003823d6454343e21949246b9820c68baa166d3dff7

SHA512
2592af48fb269855e0b013fdb13b1294a8e50b51bf26aa06b324a708df64825ad4b6b92358f6cec17f4c1adce490aecef5941836ef9ba9e516466cc33193c742

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
723KB

MD5
3f56cae6f2bcc4169086639e6781f349

SHA1
d217ead9c03612d56a18599c4fa0726b2595bd9f

SHA256
d374a04c08bbdba46c7bb830ba1c68c254de2479e214f401c6a8cc176529321c

SHA512
64e38c887366ef1ce13742eae3564faf0db532ffbf5e501606cf08d6b55f88d19f1215a9f7a512a93141025ee218bf8300da2640aaaa63662e33b76449afd31b

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
632KB

MD5
b37b815950fb382076964f65fc9c591f

SHA1
ed2d7498881b80de5c62343376dc12fc10dc414d

SHA256
0b1980c0c1adf6d15040eb94760181129fd89b97be7804f7b461f3e0bddce620

SHA512
57aded6c9cdfe8bf231c087a2075214db68c965ff9fa6cd74da43074f03a1bf0ecdb1cfa563096f220401d6209cc49828a819ad1be8fa5c544f28e60bae3810c

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
544KB

MD5
11407aff0317b8ebfb3185513038f011

SHA1
f61a90e39c55dc1e470cd0fe565db25c44887bf0

SHA256
da486ca2177920a7659c3f38053b066f81390dea18ff6c5073e70a8a27cf0aad

SHA512
6265ac9441521ff0ff8793d4a5df56bdc71a245f6aa4a1ed9d2eba2cdb003cec4e80257314beeee0e1449893ae17aa1d9aa6656b8bd4838c72dfb8fbc9d31fc9

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
585KB

MD5
da65f2280c7d656fb9331c8651460088

SHA1
87190aa59fee3ee4b413d33be7b124d2ec9c73e9

SHA256
603a9ca3c39f5854db12529e42b0e04bde9d32cd9fb1ecf6ea8ddf3ab43f1a58

SHA512
70c90cf141c43c38edced1d42b0f1106a684168dffe830e5c7acf0dfea2e8f30b866247d5a72ef5d72035b6baa555da5df6dc6084d0f3cc6df0a4cb8ab7e2a38

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
9a154286b1b354dfcfb5198404cfbaf7

SHA1
f11f8c8d64df8eac6cc604d4b79a777bd7b2e42d

SHA256
13c24951f50d8a0986ddc3ccc10b55db957870186063cdff6bda1ce7b88d8ff5

SHA512
29b702b4024baca44f57a520bb408525410f69a36e45d36be2584792e085ee9ad044cd0450bb84a5d490e96e9ce411788c50e488fad3b5b03646ac981544a92d

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
646KB

MD5
bb5edfb059d208d7eb5258fa71895248

SHA1
2b3bcc828128ce870b5ce5f12b1074c36dec7bcf

SHA256
bd3642e2742186942e256663c069b59fd42666ebb71b091a9c7f26d77067611d

SHA512
263bcaafbcaab5ba9cf3c1dd6bba990476c4044710594d3b4ba43257bf175f9ca524120d4613b666830955d7d04ed2fd3ff30fc5e1e19765dac614d8296b15c9

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
633KB

MD5
4ffebf18ea5816c8f5db7310d4b8727c

SHA1
1d83b7c25cfbe99790c36ec4ed96d1192b9a7a0b

SHA256
13aeff5f295dac2b52a0a53c6c9fd4406c04f173b14c54f3e83bea93dce6406a

SHA512
609a0bd192b5cbff8b2ddb45d909cdcfc940b99654afcdd6b0142cc5c54a8288c969240ea63bd388c4df63427be9eeb620e3e76f7b6a5d2263333d5faa31deb3

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
522KB

MD5
519a93fac8c0fc815027297a931f889a

SHA1
96e626dcc5df48d4ea053e68363abb9540a4024b

SHA256
57333c51dec61647dd5f2ee85f8dfa21e2cbf14c8a185bba1d1bc3318537bd0c

SHA512
02c5b4106b209816bdb87d651e6fdecdaa662e8fef86460596ba02436a81a53267ccd693ffda403a0feb6bcd64f72c4c814549d1bcffc2537ffad534174e517a

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
548KB

MD5
41d7c2a68105e165e912b7b75ae10950

SHA1
9db427ddd4fc579c17cc66c53840e5bdabe56070

SHA256
1739cab8f1216f6d39b326f24e430256f9739c95b78d7f40008d17794fa8e9dd

SHA512
5df4c650123b58b85c3b7a944881931c73897fdedee7431e1628ef3a34096aaf7bb67c8a3f24d55204f66be32b8c6441e01326f41c8c4c67b81b73d139a3fa24

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.0MB

MD5
b30bcdb860297a6aedbf723d66a164f0

SHA1
e41b9bca02d4c2d2d0b4a9816fa1e58601308f55

SHA256
2188759f0f2af199cd37f1a9d9b9ea4863d57c40e0d9e1c3f6c40e990e4fd003

SHA512
e592836adde449308b2e890224016a85f341377db590e394cbb543fb107eead7367dcdd9ab0ad1ad64d85ecde0200230b7fd3e9aad5c78bf3aa0b5ecc6020ff5

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.0MB

MD5
cb0f2073bad70b6dc3d4aa2447aba6e9

SHA1
47a50153938c0c3b92683fbf221d718d33763f79

SHA256
bbe3d0d17fa4ddd56db4eb3ff9d7be14cee27a7fa375ad7b7600c354610ba5dd

SHA512
e03b951d5b4756205c08c1227456cb39a30b6d444ca06db6d02f58f805e2120d1d2a295ed8b9e29916b0bbdc327c9e0d66d62eab9a36f847b7881bdacca83dd6

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
706KB

MD5
2a010f1ef08d268154013694fd2fe61a

SHA1
5d9595d51c0711d61a23d1948216adc06d7f17c7

SHA256
0c71a050821b9c2bae6693fa5369b06e97cc29eee013866c35c85b828505b041

SHA512
6313052471d312336cbdf6f0e82aceac136b6fc339e4f89a3e75475cf88bc654d91eb9b8cfd009378b97499ff16041fc99f514f72bde661a030a9ac7ab14fd5a

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
1.9MB

MD5
3649c4457f5afed4a84694aa4388e7b7

SHA1
fad23372af1bbea06dd46727e683ca984a7175b2

SHA256
55902a51bac797c544dcf6a4388c9eecb994fcb71550bed947500340baabf748

SHA512
0c71d3c580a04d2b0f80bce11c05c36dc90ba341afe0b4b203752e3d5dd63d0e30c86c40da0e8e324d6b46eadf5921ef939436d1f0c0c88d287f36d30a5d4b3a

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
7cb57f7950b8321fe30c80253b1fbe66

SHA1
a6c2dd15599420bc0aab1085d98d0f104a2db251

SHA256
d6eac08a79ea68f5bc853472e06a9296c7f9667bbf512f4ae4a579f0f034fea1

SHA512
f86c2e6dd7277bfe4a3a6fd64116b54363763c1092487bc31550818fbb1af89c2c1216c284f2257ce36ff52fbb6cb93e1121bb586c5b5a4bd86d4427f9e1dc83

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
617KB

MD5
8edbcf54d40379f86371e13a92ef1c13

SHA1
70bf6c5d83b131702d203df52823d9d1f63196fe

SHA256
9b04c6cc8e33ae56fc20c1c22886db7acb36842acf7a9ef487d86d0a146c79c0

SHA512
f35359750ed35527c59eaed8868e7063a12a410a2a7e26afa66adacf24fe9e84740bb65203d8228c463d41f08f39cd9d43e5129bee207679430520fc3625ec86

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP51E7.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5570.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5A12.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5D9B.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP60F5.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP643F.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
memory/484-173-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/484-171-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/536-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/536-54-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/536-21-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/940-410-0x0000000002F40000-0x0000000002F5A000-memory.dmp

Filesize
104KB

Download
memory/940-408-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/940-414-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/940-411-0x0000000002F60000-0x0000000002F76000-memory.dmp

Filesize
88KB

Download
memory/1000-361-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/1000-365-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1000-363-0x0000000003030000-0x0000000003040000-memory.dmp

Filesize
64KB

Download
memory/1168-151-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1168-172-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1168-333-0x0000000003160000-0x000000000317E000-memory.dmp

Filesize
120KB

Download
memory/1168-332-0x0000000003140000-0x000000000315A000-memory.dmp

Filesize
104KB

Download
memory/1168-331-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/1168-329-0x00000000003D0000-0x00000000003E8000-memory.dmp

Filesize
96KB

Download
memory/1168-335-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1484-453-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1484-450-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1552-421-0x0000000003040000-0x000000000305A000-memory.dmp

Filesize
104KB

Download
memory/1552-413-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1552-417-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/1552-416-0x00000000007B0000-0x00000000007CA000-memory.dmp

Filesize
104KB

Download
memory/1552-422-0x0000000003040000-0x000000000305A000-memory.dmp

Filesize
104KB

Download
memory/1552-432-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1600-89-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1600-165-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1600-211-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1620-288-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1620-295-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1916-368-0x0000000002FC0000-0x0000000002FCE000-memory.dmp

Filesize
56KB

Download
memory/1916-376-0x000000001C7D0000-0x000000001C7DC000-memory.dmp

Filesize
48KB

Download
memory/1916-386-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1916-371-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/1916-370-0x0000000002FF0000-0x000000000300A000-memory.dmp

Filesize
104KB

Download
memory/1916-369-0x0000000002FD0000-0x0000000002FE6000-memory.dmp

Filesize
88KB

Download
memory/1916-375-0x000000001C7D0000-0x000000001C7DC000-memory.dmp

Filesize
48KB

Download
memory/1916-367-0x0000000002F30000-0x0000000002F3C000-memory.dmp

Filesize
48KB

Download
memory/2076-328-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2076-319-0x00000000030A0000-0x00000000030AE000-memory.dmp

Filesize
56KB

Download
memory/2076-318-0x00000000030A0000-0x00000000030AE000-memory.dmp

Filesize
56KB

Download
memory/2076-311-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/2076-314-0x0000000000860000-0x0000000000876000-memory.dmp

Filesize
88KB

Download
memory/2076-313-0x0000000000700000-0x0000000000748000-memory.dmp

Filesize
288KB

Download
memory/2076-312-0x00000000006F0000-0x00000000006FC000-memory.dmp

Filesize
48KB

Download
memory/2100-1-0x0000000001003000-0x0000000001004000-memory.dmp

Filesize
4KB

Download
memory/2100-2-0x0000000001000000-0x00000000011A2000-memory.dmp

Filesize
1.6MB

Download
memory/2100-0-0x0000000001000000-0x00000000011A2000-memory.dmp

Filesize
1.6MB

Download
memory/2136-282-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2136-289-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2152-296-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2152-298-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2188-409-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2188-394-0x000000001C540000-0x000000001C554000-memory.dmp

Filesize
80KB

Download
memory/2188-393-0x000000001C490000-0x000000001C49C000-memory.dmp

Filesize
48KB

Download
memory/2188-398-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2188-399-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2188-392-0x0000000003030000-0x000000000303C000-memory.dmp

Filesize
48KB

Download
memory/2404-390-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2404-388-0x0000000003150000-0x0000000003164000-memory.dmp

Filesize
80KB

Download
memory/2404-387-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2404-385-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2444-306-0x0000000003110000-0x0000000003158000-memory.dmp

Filesize
288KB

Download
memory/2444-304-0x00000000007C0000-0x00000000007CE000-memory.dmp

Filesize
56KB

Download
memory/2444-299-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2444-307-0x0000000003160000-0x0000000003176000-memory.dmp

Filesize
88KB

Download
memory/2444-305-0x0000000002F70000-0x0000000002F7C000-memory.dmp

Filesize
48KB

Download
memory/2444-309-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2464-441-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2464-451-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2464-437-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/2604-435-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2604-433-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/2604-431-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2800-35-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2800-36-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2800-63-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2832-46-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2848-452-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2872-152-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/2872-82-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/2904-58-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download
memory/2904-150-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2904-57-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/3000-340-0x0000000002FC0000-0x0000000002FCE000-memory.dmp

Filesize
56KB

Download
memory/3000-341-0x000000001C4D0000-0x000000001C518000-memory.dmp

Filesize
288KB

Download
memory/3000-339-0x0000000002FB0000-0x0000000002FBC000-memory.dmp

Filesize
48KB

Download
memory/3000-338-0x0000000002F30000-0x0000000002F48000-memory.dmp

Filesize
96KB

Download
memory/3000-343-0x000000001CA10000-0x000000001CA2E000-memory.dmp

Filesize
120KB

Download
memory/3000-350-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/3000-351-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/3000-360-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/3000-342-0x000000001C520000-0x000000001C53A000-memory.dmp

Filesize
104KB

Download
memory/3000-336-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download