expiro | 7ef40c1bb93c82220bf7a249add169d64d4a4c8b4f1b6fcb28904da8274ae8a1

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
Size

635KB
MD5

69256e531833a416dcf7b847b78d8c10
SHA1

6474a416074fd6923c9e5a8b19465b6a6b60fc5a
SHA256

7ef40c1bb93c82220bf7a249add169d64d4a4c8b4f1b6fcb28904da8274ae8a1
SHA512

aa4d896166a93c5994283bdb1cc1058dbbd9c9a6c8d5331f178f8565c82d5d64b812a823f7734612fa1ee64297cc02552133b3777a4a2e193226b55da354db3f
SSDEEP

12288:WfjA+q11y6lRyljHViVHMctOitidSG4um411rW6V:C27l4lzYcitidSG4umw1q

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 3 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2548-2-0x0000000001000000-0x00000000011CB000-memory.dmp	family_expiro1
behavioral1/memory/1868-71-0x0000000010000000-0x00000000101B7000-memory.dmp	family_expiro1
behavioral1/memory/1520-82-0x0000000140000000-0x0000000140371000-memory.dmp	family_expiro1

Executes dropped EXE 64 IoCs

pid	Process
1868	mscorsvw.exe
476	Process not Found
2936	mscorsvw.exe
2792	mscorsvw.exe
2768	mscorsvw.exe
1520	elevation_service.exe
2620	IEEtwCollector.exe
3028	mscorsvw.exe
772	mscorsvw.exe
860	mscorsvw.exe
1076	mscorsvw.exe
3008	mscorsvw.exe
2820	mscorsvw.exe
1264	mscorsvw.exe
1556	mscorsvw.exe
1748	mscorsvw.exe
900	mscorsvw.exe
2864	mscorsvw.exe
2148	mscorsvw.exe
2896	mscorsvw.exe
936	mscorsvw.exe
2912	mscorsvw.exe
2596	mscorsvw.exe
1860	mscorsvw.exe
2832	mscorsvw.exe
648	mscorsvw.exe
3056	mscorsvw.exe
2692	mscorsvw.exe
3040	mscorsvw.exe
1992	mscorsvw.exe
1832	mscorsvw.exe
1772	mscorsvw.exe
2600	mscorsvw.exe
2320	mscorsvw.exe
1876	mscorsvw.exe
2924	mscorsvw.exe
1808	mscorsvw.exe
1912	mscorsvw.exe
2636	mscorsvw.exe
264	mscorsvw.exe
2380	mscorsvw.exe
2964	mscorsvw.exe
1632	mscorsvw.exe
2208	mscorsvw.exe
3044	mscorsvw.exe
2276	mscorsvw.exe
2664	mscorsvw.exe
2512	mscorsvw.exe
2804	mscorsvw.exe
2828	mscorsvw.exe
2844	mscorsvw.exe
2760	mscorsvw.exe
2160	mscorsvw.exe
2700	mscorsvw.exe
1880	mscorsvw.exe
2220	mscorsvw.exe
2832	mscorsvw.exe
1532	mscorsvw.exe
860	mscorsvw.exe
1776	mscorsvw.exe
1352	mscorsvw.exe
2992	mscorsvw.exe
1768	mscorsvw.exe
1800	mscorsvw.exe

Loads dropped DLL 54 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
1264	mscorsvw.exe
1264	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
2864	mscorsvw.exe
2864	mscorsvw.exe
2896	mscorsvw.exe
2896	mscorsvw.exe
2912	mscorsvw.exe
2912	mscorsvw.exe
1860	mscorsvw.exe
1860	mscorsvw.exe
648	mscorsvw.exe
648	mscorsvw.exe
2692	mscorsvw.exe
2692	mscorsvw.exe
1992	mscorsvw.exe
1992	mscorsvw.exe
1772	mscorsvw.exe
1772	mscorsvw.exe
2320	mscorsvw.exe
2320	mscorsvw.exe
2924	mscorsvw.exe
2924	mscorsvw.exe
1912	mscorsvw.exe
1912	mscorsvw.exe
264	mscorsvw.exe
264	mscorsvw.exe
2964	mscorsvw.exe
2964	mscorsvw.exe
2208	mscorsvw.exe
2208	mscorsvw.exe
2828	mscorsvw.exe
2828	mscorsvw.exe
2844	mscorsvw.exe
2844	mscorsvw.exe
2160	mscorsvw.exe
2160	mscorsvw.exe
2108	mscorsvw.exe
2108	mscorsvw.exe
2108	mscorsvw.exe
2108	mscorsvw.exe
1312	mscorsvw.exe
1312	mscorsvw.exe
1532	mscorsvw.exe
1532	mscorsvw.exe
780	mscorsvw.exe
780	mscorsvw.exe
1672	mscorsvw.exe
1672	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1846800975-3917212583-2893086201-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1846800975-3917212583-2893086201-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\K:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\M:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\O:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\Q:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\Y:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\H:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\S:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\T:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\N:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\Z:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\X:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\E:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\G:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\P:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\R:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\U:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\W:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\I:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\V:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\J:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened (read-only)	\??\L:	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File created	\??\c:\windows\system32\alg.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\msdtc.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\vds.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\ui0detect.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\vssvc.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\DVD Maker\DVDMaker.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\7-Zip\7z.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Internet Explorer\ielowutil.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Program Files\Internet Explorer\ieinstal.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6D82.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15c.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6900.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP60E5.tmp\Microsoft.Office.Tools.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPD76B.tmp\Microsoft.Office.Tools.Common.v9.0.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8C87.tmp\stdole.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.vir	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE9C3.tmp\Microsoft.Office.Tools.Word.v9.0.dll	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5486.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe
2768	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2548	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe
Token: SeShutdownPrivilege	2768	mscorsvw.exe

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
2548	JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3028	2768	mscorsvw.exe	38
PID 2768 wrote to memory of 3028	2768	mscorsvw.exe	38
PID 2768 wrote to memory of 3028	2768	mscorsvw.exe	38
PID 2768 wrote to memory of 772	2768	mscorsvw.exe	39
PID 2768 wrote to memory of 772	2768	mscorsvw.exe	39
PID 2768 wrote to memory of 772	2768	mscorsvw.exe	39
PID 2768 wrote to memory of 860	2768	mscorsvw.exe	40
PID 2768 wrote to memory of 860	2768	mscorsvw.exe	40
PID 2768 wrote to memory of 860	2768	mscorsvw.exe	40
PID 2768 wrote to memory of 1076	2768	mscorsvw.exe	41
PID 2768 wrote to memory of 1076	2768	mscorsvw.exe	41
PID 2768 wrote to memory of 1076	2768	mscorsvw.exe	41
PID 2768 wrote to memory of 3008	2768	mscorsvw.exe	42
PID 2768 wrote to memory of 3008	2768	mscorsvw.exe	42
PID 2768 wrote to memory of 3008	2768	mscorsvw.exe	42
PID 2768 wrote to memory of 2820	2768	mscorsvw.exe	43
PID 2768 wrote to memory of 2820	2768	mscorsvw.exe	43
PID 2768 wrote to memory of 2820	2768	mscorsvw.exe	43
PID 2768 wrote to memory of 1264	2768	mscorsvw.exe	44
PID 2768 wrote to memory of 1264	2768	mscorsvw.exe	44
PID 2768 wrote to memory of 1264	2768	mscorsvw.exe	44
PID 2768 wrote to memory of 1556	2768	mscorsvw.exe	45
PID 2768 wrote to memory of 1556	2768	mscorsvw.exe	45
PID 2768 wrote to memory of 1556	2768	mscorsvw.exe	45
PID 2768 wrote to memory of 1748	2768	mscorsvw.exe	46
PID 2768 wrote to memory of 1748	2768	mscorsvw.exe	46
PID 2768 wrote to memory of 1748	2768	mscorsvw.exe	46
PID 2768 wrote to memory of 900	2768	mscorsvw.exe	47
PID 2768 wrote to memory of 900	2768	mscorsvw.exe	47
PID 2768 wrote to memory of 900	2768	mscorsvw.exe	47
PID 2768 wrote to memory of 2864	2768	mscorsvw.exe	48
PID 2768 wrote to memory of 2864	2768	mscorsvw.exe	48
PID 2768 wrote to memory of 2864	2768	mscorsvw.exe	48
PID 2768 wrote to memory of 2148	2768	mscorsvw.exe	49
PID 2768 wrote to memory of 2148	2768	mscorsvw.exe	49
PID 2768 wrote to memory of 2148	2768	mscorsvw.exe	49
PID 2768 wrote to memory of 2896	2768	mscorsvw.exe	50
PID 2768 wrote to memory of 2896	2768	mscorsvw.exe	50
PID 2768 wrote to memory of 2896	2768	mscorsvw.exe	50
PID 2768 wrote to memory of 936	2768	mscorsvw.exe	51
PID 2768 wrote to memory of 936	2768	mscorsvw.exe	51
PID 2768 wrote to memory of 936	2768	mscorsvw.exe	51
PID 2768 wrote to memory of 2912	2768	mscorsvw.exe	52
PID 2768 wrote to memory of 2912	2768	mscorsvw.exe	52
PID 2768 wrote to memory of 2912	2768	mscorsvw.exe	52
PID 2768 wrote to memory of 2596	2768	mscorsvw.exe	53
PID 2768 wrote to memory of 2596	2768	mscorsvw.exe	53
PID 2768 wrote to memory of 2596	2768	mscorsvw.exe	53
PID 2768 wrote to memory of 1860	2768	mscorsvw.exe	54
PID 2768 wrote to memory of 1860	2768	mscorsvw.exe	54
PID 2768 wrote to memory of 1860	2768	mscorsvw.exe	54
PID 2768 wrote to memory of 2832	2768	mscorsvw.exe	55
PID 2768 wrote to memory of 2832	2768	mscorsvw.exe	55
PID 2768 wrote to memory of 2832	2768	mscorsvw.exe	55
PID 2768 wrote to memory of 648	2768	mscorsvw.exe	56
PID 2768 wrote to memory of 648	2768	mscorsvw.exe	56
PID 2768 wrote to memory of 648	2768	mscorsvw.exe	56
PID 2768 wrote to memory of 3056	2768	mscorsvw.exe	57
PID 2768 wrote to memory of 3056	2768	mscorsvw.exe	57
PID 2768 wrote to memory of 3056	2768	mscorsvw.exe	57
PID 2768 wrote to memory of 2692	2768	mscorsvw.exe	58
PID 2768 wrote to memory of 2692	2768	mscorsvw.exe	58
PID 2768 wrote to memory of 2692	2768	mscorsvw.exe	58
PID 2768 wrote to memory of 3040	2768	mscorsvw.exe	59

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69256e531833a416dcf7b847b78d8c10.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookAW
PID:2548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2792

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 160 -NGENProcess 190 -Pipe 19c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 254 -NGENProcess 234 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 20c -NGENProcess 204 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 260 -NGENProcess 198 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 230 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 204 -Pipe 160 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 198 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 204 -NGENProcess 198 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 278 -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 26c -NGENProcess 280 -Pipe 204 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 264 -NGENProcess 270 -Pipe 230 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 27c -Pipe 15c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 20c -NGENProcess 270 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 270 -NGENProcess 284 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 290 -NGENProcess 27c -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 27c -NGENProcess 20c -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 298 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 284 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a0 -NGENProcess 20c -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 20c -NGENProcess 298 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 278 -NGENProcess 2a4 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2a4 -NGENProcess 2a0 -Pipe 198 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2b0 -NGENProcess 298 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 298 -NGENProcess 278 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2b8 -NGENProcess 2a0 -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2a0 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 278 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 278 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2d0 -NGENProcess 2b0 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d8 -NGENProcess 2b8 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2b8 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2e0 -NGENProcess 2c0 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c0 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d0 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2f4 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2e8 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2e0 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2f4 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2f4 -NGENProcess 300 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 300 -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 314 -NGENProcess 30c -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 30c -NGENProcess 2f4 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 31c -NGENProcess 2d8 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 318 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2f4 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2d8 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 318 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2f4 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 334 -NGENProcess 2d8 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 318 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 324 -NGENProcess 2f4 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 33c -NGENProcess 32c -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 318 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2f4 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 32c -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 318 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2f4 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:2204
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 348 -NGENProcess 354 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:2208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 358 -NGENProcess 318 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:2476
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2f4 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 354 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 318 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:1624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 2f4 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 354 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 318 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 318 -NGENProcess 368 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 378 -NGENProcess 354 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 374 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:1276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 368 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 354 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 374 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:2056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 368 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 354 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 374 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:1044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 368 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:2452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 354 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:1284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 388 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:1000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 368 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 354 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:2964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 388 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3ac -NGENProcess 3a8 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 39c -NGENProcess 388 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 354 -NGENProcess 3a4 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:1788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 3b4 -NGENProcess 3a0 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:2544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 388 -Pipe 210 -Comment "NGen Worker Process"
  2⤵
  PID:2816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3a4 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 3a0 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 388 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:1376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3a4 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3a0 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 388 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d0 -NGENProcess 3cc -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3d0 -NGENProcess 3d4 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3c0 -NGENProcess 3cc -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:3064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3e0 -NGENProcess 3c4 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 3d4 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3d4 -NGENProcess 3c0 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3ec -NGENProcess 3c4 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3c4 -NGENProcess 3e4 -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3f4 -NGENProcess 3c0 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3ec -NGENProcess 3f8 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3d4 -NGENProcess 3c0 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3c0 -NGENProcess 3d8 -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 404 -NGENProcess 3f8 -Pipe 134 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 3f8 -NGENProcess 3d4 -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:1064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 414 -NGENProcess 3ec -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 410 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:2468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3d4 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:2316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 3ec -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 410 -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  PID:3060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 3d4 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 3ec -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:2668

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

Filesize
640KB

MD5
67b05e2cce65145e1fefe598510d91ff

SHA1
374717037e818348050f1d170c33f3a9fc667bdf

SHA256
c840486daf4b706107a9fa2a33e78af5c7006620b8e3e58833f1aa10d020c53c

SHA512
13725958e6ad297fbdfc0b304594b6cb948a9fdc7ea951e07e812b85cd3875b2dc2b0513d85dfa49ae46812ee6eaf6fef706d1ac33f06bcc36d6dba170b06214

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.5MB

MD5
9c6ac542282449dd27f485f5817cded3

SHA1
b32456e1f20f6eaecff4d4d3fa1da9ba3965a926

SHA256
0e0ffb23128ac8a1ea36311e8b98f3121b2c1c38ad92a3f4c34ca8b07170827d

SHA512
c79b3fb36e3fe3cc29bea18ea9cef57f096eb59bf1fafb429d079a92248763cc3fecd2a9da9972658aa3ccfbc2c90659dde201954ff9b7bc0371acca7fb1b672

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
35c560f254e8dd4c705f26f155c959a5

SHA1
6ed658e344a3215958ad8f5074b53e1048963041

SHA256
07582cc45835172c863b23fce009885077fd94242e58b2c1eb8cc1a78293b913

SHA512
0b5554e7396af6c11441c58cdf68f68cbbff78063567392fdbcb37fe29c7ba175ecce7e5e153f8baef0df7d1921ce9f9a9332ff3a764ea8cdf749275d0a5732f

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
67fdc3bb90deec78ee292b3837d2112d

SHA1
561dbe4b47a3640e2327deca57d5d5d060d1cc83

SHA256
a3deafdc1c74566ef8db87d0385aa57351920460497b519dc9f8ddbb9fee7e2d

SHA512
36aecac7d4f590cae58c7740a4724334fd442d261df6c5dc1cc1fb0e19f38bf09511cf7bc08bb2f74cd8fe0d732a99b4393e4931aa55053e2d75ad2f5d0ae4da

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.2MB

MD5
debeab1cfc5c55dc6db066efc619354f

SHA1
c46c5bc413440214c0456acd021d5ecda6758b75

SHA256
c11f2980227c834b21e1e5ad3127cc99d4fe0f7c30620527e8dc721634df7e97

SHA512
b23765320556a1367b4b83fccf46146c020411eec3bd21813949fea2b5f9be98f47d5b95fc41515b75e2564117d7256e089426362cf47a09f490aa8efc2c6cac

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
d0b1e6a01c55ceeaf9ce3b54d62dc8d5

SHA1
bc149ae556314cf65b5f8b275af924862703dca5

SHA256
a2a4b8a23bff8b3ccb95def8cf5ecdf3d40cfdadaf978af542540b262bf0b728

SHA512
e7c5dca6a29c264b79f5788fa8a28b510c0099a757dbc646053805362fe3777ebc09aafbc1742fbba61edc60673f2a7bdfac6d9c377349980bc92a1b2a6aec3c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
4a1f50ae4890a0f7850fa29c96d4099e

SHA1
74ce3b6fec98e50d58248fde001736dd123edc07

SHA256
7ae3d34ac5a4ac4d924512d16ed40c1a6a153a70f2a77881fd46245047c62dd7

SHA512
a77dff245e53530d87b7d7ffe9d0d07d4406c4c70b32204b22ffaa914b2f03e5e06a02764a8b94d132d9cfcfef7aff5d1770e247be1f893696f38f46bc606999

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
559KB

MD5
aec56e9926318e4a52554a2f0a89ffa3

SHA1
722e58d4f922798eaba93e8d5c77301dc03334d4

SHA256
26248a4b8c4fee42a150df2df726513e2b33415da3546808b762b293c66046fb

SHA512
0ad1663c9ca4a30ea98d4dffeaa2f78121a336d9bc31f1fa1c26fff2c7ca2308fa9a6111e24ca8dad37fe479cf982ee908f6b2af93819bc897a04f5eb00a59f6

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
0c3b500c5f5c90aa832fbea7e33dea3d

SHA1
47428615762837126e88e0c209bb6df2b2f6fff1

SHA256
3e3bbeb7a68e2016a1bcf97bec925740e33d3f8333dbd7074618fed41b7abdfe

SHA512
447fb5cc63512002b86d011f7088ee483163d4ba075047a369ba1da0035178002e949a55b2703ae88baf2b572a8a42a58f5657b5edbca490cea724985b1d313d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
590KB

MD5
31074957cdeb6866344969f976861dd0

SHA1
0c02f6522d920717b4a01a9a43b653a3fcba07e1

SHA256
254fed3dced6094b0a12f6c2a59a2f52597251a2c8e2e15d86aca289af6ea01b

SHA512
65c251cc21008da545df3ba5bf7607912c765a6c59c80a626d7f946f82668591781ca67cca79fc6c18ef3ce96080ee071de9327fdd92cd59082144618c48a6b9

Download Submit
C:\Windows\Temp\CabD633.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarD78C.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\7adcc294aaa53f02c5b38c75d35edc08\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
2b428be1bf04f3fe0940cd3359a77f1a

SHA1
e3e7384c7cf551590c6d4284a29bf1efab673080

SHA256
15951a131f998f63fa2e3ba9f012a27a52e19e70bc2c04d3ce08832a005a2be7

SHA512
c8933e3265d3e6f3cceb25b82c5d69fce2a625cb5062626a8b2ed177be19f489d2eda20aff91b1678be8b41aad8293659d3d9e175e35b1a0a5633c9bf3461e2a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a53dc46b1a12eb0c2932e0ee97da15f5\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
1fb32b7135d6e6c31f8918d582fc85d6

SHA1
1d45227def72aea3c2427c6272b01f3d92032d48

SHA256
ad411b330a384f43baf941eea32bace988d3cb8c9141bba25a032b5093ab12eb

SHA512
418d79c58d9fb8ef7c1d8618295e52af454ff092854e2d00caa7da2982e6839c181340bd6a451ba00434b6b73cfd2c45d10aadab2e5f5d6e81a956029fb2c65d

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ce82c9b12db30096f1529fd36cb6df73\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
c42885eade46f76437557992dc40e69d

SHA1
eb783317c9249f6ccfc1611ed616d4935d9917e4

SHA256
740d4293efda4d4168f691587d5a45b79f8d51a34ac730c087491950f94d9d9f

SHA512
892fea5564a644e64fe78a61bad62c9f81e939e3009eaec2a2d88f870735672e1135372c7328d2a993b345fc2f5ae88752446b54f59db3e6f0c6a9ef9c2fc0dc

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ef57b879ffd7b748c890e146fb8dab94\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
40770001b1f8c7cf4f41b22ea13c8bd7

SHA1
3c3e27b399c0c9a94d3aa715f595f1ea1b15a279

SHA256
5cd098f66ed17ce7e905b8d1cf0f53162d458712ed0636b228b3bc1236c3c56b

SHA512
6e85f497845de3d3b24573460ddb2f7f2606e44a80b8c7c82c812f0ceb5b5cd91f42b4f9f1c2576955460d02bbc42831258d4d82ca1da32041606aba6eb293cd

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
640KB

MD5
e6a47d59aa43832fae28fb6f9ccd27b2

SHA1
d8b9378aa16db00125e6e5c05dbf8d482e32b064

SHA256
f8025812e1c8feb51773ae5bb9791ed25d190194248385ffdc0756466f5d3718

SHA512
b8415ba6e6a9b89aaa704264b2f198ca7583eac6bf44563afef6b84a0876fdceda6c70e4e0cd238feb513727407d524fde0d709766cad37e8df5fc765e82dd1e

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.0MB

MD5
655dbbc5b109ef165cec37fc1e955a6c

SHA1
e9b42a1f0b6390148f39449549ddd8ff9a05d4e0

SHA256
d88c2df9e76ff6d394a356831b684431f72c96f7a61876dac172f950bb6a8c9b

SHA512
117b6ae948ef430d39498b12d7d406d81e276134e6aecc8467e2730ffdef1b8d8ba88e105b756b5e7de7f063bd26a47c7a12bf0ed1f6fd3fc5ca8c12789334f5

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
715KB

MD5
ff9e1f8bff0f663776ce527c97f24a5b

SHA1
220bdde27665f9dc50ef999961e93e76fcd67aa4

SHA256
f94d3b7d14cff3225fe64092bd7e1329a1ca864453d62b0f4926465d4a31939f

SHA512
09e4b6249a4e867b41411a2bae8ec4c2415fe9ebd2d7a14ad8a671cf0977e89a9fa9ca76bfd986271dc01f32f644657cc6a13d6d35b719996d1dc651db3288d1

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
624KB

MD5
7d60c93a35d225232877bc8d3c2c9ae1

SHA1
03502d9be84fb0f6af22804e1356db50cb98d203

SHA256
deedbaa4feb12857122dcf10facb823d2a53d1093c9ee7e73793309fe5e6d2a5

SHA512
ba353695dd3e6cd19706d4421eaf4a6584db9329167d398915aebb427189b00dd428e893e7989a5706e7850b2c790e397610b83946ecf7c8b1fe09575c73e7f9

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
536KB

MD5
d8a8dd57b8eadd25e615ccce6af17636

SHA1
ee8c670e4c44a0f9e36c7d6f794336d2db2e7cb3

SHA256
a33250ee5e907573f7f4c8ef147b6e714737902191fc7d75671e66ec6b5e2df8

SHA512
7d8b9085e31f44396b19068632943679c0d8e2e9f010bab4b1951f8d7d1c87872ae3b077009e8fa08a86c9b55238163e227bbf72c21a07603ed150acd937b343

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
577KB

MD5
43ae5536d24be4980029ce710978a091

SHA1
089a89abf2ef1622d7c458abbf838760a90c9ec7

SHA256
88af3b432c7649971b23f2937d87c8b36a8b568e043fca8df66a6db5a3894ec7

SHA512
d87afd34079861a9b2e4e77e5810372370b9f79f3a4a31c2e226688367dd391c24e316e9b03f3bd9047fcd2df707eed09499f0f9b31e69d5d953f066dd9d7432

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.1MB

MD5
dc12dd5da149d50e1949a979c4d405ec

SHA1
026cdb005fe4ae174b85b79dabcf25a5314823cc

SHA256
0b781e52d7b4d3f5556328efd2edfa7c18442a2ba59a0b519dd21e494c2783d5

SHA512
d7a9e8db107eabc0e423e95a0e8746b29c7963705fa45bfb3ca4e3235be17f1c94501c8cbbd12f6db5548659f529b7e6caa24cc35a7407478f57207a381d762f

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
638KB

MD5
4bae071c5e5ce93a39b2c7a42fd796ce

SHA1
11e56f552907a548a820e8a48f4ba39a0e3ead48

SHA256
c87e22feffca60277fed9459788fe8b868eaaacf3c01d42366ac56cfc49786c4

SHA512
2f70aefa8058dd19aa940d6028fc12e8e7033e2bf94f2fc54f25897a915660f024bcc92e942b21a7753ef1a3477ed1e0c0e7c2d843544ae5755c5d4521a9000f

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
625KB

MD5
82660ce7baebcb591dec1f1bcbf97253

SHA1
30b2706ebd29e59fff2923a95ae3f5d6f25f7844

SHA256
955b862314964075188e9f83ec96c6c583fc6654b4ee1b6f72e11f0c21b91c9e

SHA512
f97f1760234b4fe6a127c1b08988946a631bc4aab26a62274b096b8910b08eabe79d67944438ce7d7a62ef5b4b86d7a6f0913928dd1a9d6a06f2dffd8c92ccc2

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
514KB

MD5
0f48154f6e5fadeac0dad59ca0531e4a

SHA1
20547e483d4ce5fb33ecf991872b53f67465b1c3

SHA256
a6f7f199f6c702595179b6a2561a4d25e5307eaa62cb4972b300c0563a6013e1

SHA512
b70bc257494139cacef649df3c447abffbe7b3cae41c058a96e7db5c849a1d30f58aad0c9e1d4cff1258a2dc39edba3caf53b96b0c9da3eee69279ef8f31a2bd

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
540KB

MD5
55bcd1028b421a5606c8e5e9e2a83e6b

SHA1
56c3066d010d74219980ca6e2de1f07fc13d9014

SHA256
acf0ed9455259253bdf91a1eed75c2311919d38242a916eae438210bd137bd15

SHA512
9542baa64746e180bacb588e246653ddf258084cb18077af89d9faac301d3cf79fb142ce0bf6e5deb4dbeb5c822fe127c07af023f3515b2de566eb99c6fe4fa8

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1021KB

MD5
de4beea36b7702adad739dceaba186a2

SHA1
98d932771732cf42a4efe50ae14f5af2a8b05c72

SHA256
16dbf1357260e2d94530ddcaf584428686fa5f91943f5645973832af2aa4d877

SHA512
0ef89bb5b760a051c98090db0d390c2b6deda29c5af939a57b2bbb055637e6d27cd66245fe662f85d08b534bafbeda359e89f9845b08d9d2696966e8ec779ae7

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.0MB

MD5
9759a1920df0f3314ed01712ecaa8a0a

SHA1
2b6070c7b3e2a6dfa86c337dcb0325df16ac4783

SHA256
4ff5522808cbce70dd82b1a197a5d381b0d1da4252c7627fb0864001d520b616

SHA512
34227d951a2101555280af75b0e0c05564356e7bb51612607425f6a8d26035994d58ffa0d2df517c0ff93497119a87a973d6b37b6ac08386e19ef92e38ced19d

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
698KB

MD5
917a5bcc19959214288ba055a3e4128a

SHA1
3c2145746d6985f209b0de9957c2cbc98453c98c

SHA256
419de7cfcaac1dba1e78a454c7ae1b39bc3df3ac41ba410d11009791893c6bfe

SHA512
df7dfd8b75187a666ee34e1e267679a7e26c7b3a5c7a98f58af07705bd4477002612ee844a1ba1239e026a562d570bb2e6c917c1b97059d3e5be3105a70abbb9

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
1.9MB

MD5
3a5f2886e831f34d0d8cedb1ae030ffa

SHA1
11681cd60380c99ef63f108e0204f9dbb76d53cb

SHA256
ab8e38664245412a14e68372b368e371c04a7fc63caa5d00be3b1fcf5fd3763f

SHA512
6132bd4d580abc9fc800b37e89c5303303fa9e98374a0d8195a70566fd900942eab4616c0d500ee7e33410629dd2123e8905ef4fca273ab8c58fad42d6f6e898

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
582KB

MD5
746343773d8a8936b1a1f01116a562ce

SHA1
efbe10c4f6ed7232ee92c4bf2feb1f6f4711a8f8

SHA256
64badd6a2cf52b54419560b7182597237bf96d0aed57add645b713ce4330d269

SHA512
d4c3c375797efde00e6bd728ba488a309066227262e2e946ee72189f5f3482dd1371dd7b5aff54a70556e96fc481ebf3ada3fbd88799b59b070fe63745f6b2f1

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
1ddfbfbc582f1b86710b3f9efa16391b

SHA1
c9f3193a3f8f74345c74d9be2bfef0357982461e

SHA256
34623b3f8b3e2b85f9b7a3d114b84f52963f50ec8862de8b8161cc8b60125f62

SHA512
1c9f0cd85803b677749707c2312b403f4cdc66d5d138c1e18193c7d9a860e395a969eca0d93c1cfa4a5c7a01e6be0ff84a7781bb06169446de7517ec37319fd9

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
609KB

MD5
4a092c2588fec2f2ff20733383770958

SHA1
38438743e05a4f68164647228e7e1a28c489262e

SHA256
14ef1551b1a34d52b7bbce8de6f06e9c1333a91a353ad3fc03bb7c5aed5157d3

SHA512
bf02fcc2f8205c9a7328521ee7d738f8355a2728c1c3b2d3ed7558c25fca3838f4ba323c4f482923cf6666236a49f62995079f58c7f8d4fd515b8a02055fbfb7

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5486.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5792.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5B0B.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5E17.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP60E5.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6401.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
memory/772-180-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/860-299-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/900-374-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/900-369-0x0000000000720000-0x000000000072C000-memory.dmp

Filesize
48KB

Download
memory/900-371-0x00000000031B0000-0x00000000031C0000-memory.dmp

Filesize
64KB

Download
memory/900-368-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/936-421-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download
memory/936-422-0x00000000005C0000-0x00000000005D6000-memory.dmp

Filesize
88KB

Download
memory/936-425-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1076-302-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1264-320-0x0000000000940000-0x000000000094E000-memory.dmp

Filesize
56KB

Download
memory/1264-313-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/1264-312-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/1264-315-0x0000000000880000-0x0000000000896000-memory.dmp

Filesize
88KB

Download
memory/1264-329-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1264-314-0x0000000000810000-0x0000000000858000-memory.dmp

Filesize
288KB

Download
memory/1264-319-0x0000000000940000-0x000000000094E000-memory.dmp

Filesize
56KB

Download
memory/1520-82-0x0000000140000000-0x0000000140371000-memory.dmp

Filesize
3.4MB

Download
memory/1520-165-0x0000000140000000-0x0000000140371000-memory.dmp

Filesize
3.4MB

Download
memory/1556-334-0x00000000032D0000-0x00000000032EA000-memory.dmp

Filesize
104KB

Download
memory/1556-337-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1556-335-0x00000000032F0000-0x000000000330E000-memory.dmp

Filesize
120KB

Download
memory/1556-330-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1556-333-0x0000000000810000-0x000000000081E000-memory.dmp

Filesize
56KB

Download
memory/1556-331-0x00000000007C0000-0x00000000007D8000-memory.dmp

Filesize
96KB

Download
memory/1748-348-0x000000001C4D0000-0x000000001C518000-memory.dmp

Filesize
288KB

Download
memory/1748-358-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/1748-357-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/1748-350-0x000000001CA10000-0x000000001CA2E000-memory.dmp

Filesize
120KB

Download
memory/1748-367-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1748-345-0x0000000002FA0000-0x0000000002FAC000-memory.dmp

Filesize
48KB

Download
memory/1748-346-0x0000000003130000-0x000000000313E000-memory.dmp

Filesize
56KB

Download
memory/1748-347-0x0000000003140000-0x0000000003156000-memory.dmp

Filesize
88KB

Download
memory/1748-349-0x000000001C520000-0x000000001C53A000-memory.dmp

Filesize
104KB

Download
memory/1748-338-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1748-344-0x0000000002F30000-0x0000000002F48000-memory.dmp

Filesize
96KB

Download
memory/1860-445-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1860-448-0x0000000002F10000-0x0000000002F1E000-memory.dmp

Filesize
56KB

Download
memory/1868-71-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/1868-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/1868-21-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/2148-400-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2148-397-0x000000001C530000-0x000000001C544000-memory.dmp

Filesize
80KB

Download
memory/2148-396-0x00000000007C0000-0x00000000007CC000-memory.dmp

Filesize
48KB

Download
memory/2548-1-0x0000000001008000-0x0000000001009000-memory.dmp

Filesize
4KB

Download
memory/2548-0-0x0000000001000000-0x00000000011CB000-memory.dmp

Filesize
1.8MB

Download
memory/2548-2-0x0000000001000000-0x00000000011CB000-memory.dmp

Filesize
1.8MB

Download
memory/2596-443-0x0000000003040000-0x000000000304E000-memory.dmp

Filesize
56KB

Download
memory/2596-446-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2596-442-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2620-89-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2620-169-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2620-219-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2768-57-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download
memory/2768-56-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2768-149-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2792-45-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/2820-305-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/2820-307-0x0000000002FA0000-0x0000000002FE8000-memory.dmp

Filesize
288KB

Download
memory/2820-306-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2820-310-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2820-308-0x0000000002FF0000-0x0000000003006000-memory.dmp

Filesize
88KB

Download
memory/2864-377-0x0000000000840000-0x000000000084C000-memory.dmp

Filesize
48KB

Download
memory/2864-395-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2864-373-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2864-387-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2864-386-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2864-382-0x0000000000860000-0x0000000000870000-memory.dmp

Filesize
64KB

Download
memory/2864-381-0x00000000032F0000-0x000000000330A000-memory.dmp

Filesize
104KB

Download
memory/2864-380-0x0000000003100000-0x0000000003148000-memory.dmp

Filesize
288KB

Download
memory/2864-379-0x00000000030E0000-0x00000000030F6000-memory.dmp

Filesize
88KB

Download
memory/2864-378-0x0000000000850000-0x000000000085E000-memory.dmp

Filesize
56KB

Download
memory/2864-376-0x00000000007C0000-0x00000000007CC000-memory.dmp

Filesize
48KB

Download
memory/2896-412-0x0000000003260000-0x000000000326C000-memory.dmp

Filesize
48KB

Download
memory/2896-411-0x0000000003260000-0x000000000326C000-memory.dmp

Filesize
48KB

Download
memory/2896-406-0x0000000003040000-0x000000000305A000-memory.dmp

Filesize
104KB

Download
memory/2896-420-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2896-405-0x0000000002FF0000-0x0000000003038000-memory.dmp

Filesize
288KB

Download
memory/2896-407-0x0000000003060000-0x0000000003074000-memory.dmp

Filesize
80KB

Download
memory/2896-403-0x0000000000840000-0x000000000084C000-memory.dmp

Filesize
48KB

Download
memory/2896-402-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2896-404-0x0000000000850000-0x000000000085E000-memory.dmp

Filesize
56KB

Download
memory/2896-399-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2912-432-0x000000001CCF0000-0x000000001CD0A000-memory.dmp

Filesize
104KB

Download
memory/2912-427-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/2912-428-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/2912-433-0x000000001CCF0000-0x000000001CD0A000-memory.dmp

Filesize
104KB

Download
memory/2912-424-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2912-441-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2936-41-0x0000000010000000-0x00000000101E1000-memory.dmp

Filesize
1.9MB

Download
memory/2936-33-0x0000000010000000-0x00000000101E1000-memory.dmp

Filesize
1.9MB

Download
memory/2936-62-0x0000000010000000-0x00000000101E1000-memory.dmp

Filesize
1.9MB

Download
memory/3008-301-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/3008-304-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/3028-153-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/3028-175-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download