expiro | d67bc9c954a176b1efd11a61abbb6c4f2ac9d6f1cd16e16246b15f5cef2b4851

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/01/2025, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
Size

684KB
MD5

6c846c3f737167948ae219bcc5bf53c0
SHA1

efcea049f211ec2cd9e18048baf2c8f7f730d931
SHA256

d67bc9c954a176b1efd11a61abbb6c4f2ac9d6f1cd16e16246b15f5cef2b4851
SHA512

fc1122f97138bd36708703b0306a646c65950d383f33ca4197eb05a1c56c9f7f23349e2086466ddb278a4aa504198b01b1214bad6b3fb4170e6613b26599559c
SSDEEP

12288:NcBj7B40qvxUrevFtrh7Xj5qS3ZIIOuPZfSVPP9jCW71D5b6pHJ1:NcBj7B4UevFhh7z5qS3QWfgP171tbKHb

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2792-2-0x0000000000400000-0x0000000000668000-memory.dmp	family_expiro1
behavioral1/memory/2820-54-0x0000000010000000-0x0000000010258000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 64 IoCs

pid	Process
2820	mscorsvw.exe
476	Process not Found
2584	mscorsvw.exe
2276	mscorsvw.exe
2236	mscorsvw.exe
2952	elevation_service.exe
2824	IEEtwCollector.exe
968	mscorsvw.exe
1928	mscorsvw.exe
2112	mscorsvw.exe
2040	mscorsvw.exe
108	mscorsvw.exe
1552	mscorsvw.exe
2096	mscorsvw.exe
2296	mscorsvw.exe
1640	mscorsvw.exe
1792	mscorsvw.exe
2592	mscorsvw.exe
2104	mscorsvw.exe
1040	mscorsvw.exe
3008	mscorsvw.exe
2632	mscorsvw.exe
332	mscorsvw.exe
2336	mscorsvw.exe
1076	mscorsvw.exe
1408	mscorsvw.exe
2508	mscorsvw.exe
1652	mscorsvw.exe
1876	mscorsvw.exe
1872	mscorsvw.exe
2468	mscorsvw.exe
1744	mscorsvw.exe
2968	mscorsvw.exe
2964	mscorsvw.exe
2580	mscorsvw.exe
1676	mscorsvw.exe
2168	mscorsvw.exe
2880	mscorsvw.exe
2632	mscorsvw.exe
2776	mscorsvw.exe
1940	mscorsvw.exe
844	mscorsvw.exe
1312	mscorsvw.exe
820	mscorsvw.exe
2296	mscorsvw.exe
2676	mscorsvw.exe
1716	mscorsvw.exe
2016	mscorsvw.exe
2848	mscorsvw.exe
2592	mscorsvw.exe
2164	mscorsvw.exe
2896	mscorsvw.exe
1936	mscorsvw.exe
2672	mscorsvw.exe
2376	mscorsvw.exe
1984	mscorsvw.exe
3020	mscorsvw.exe
2120	mscorsvw.exe
2064	mscorsvw.exe
2128	mscorsvw.exe
284	mscorsvw.exe
1564	mscorsvw.exe
2224	mscorsvw.exe
1968	mscorsvw.exe

Loads dropped DLL 52 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
2096	mscorsvw.exe
2096	mscorsvw.exe
1640	mscorsvw.exe
1640	mscorsvw.exe
2592	mscorsvw.exe
2592	mscorsvw.exe
1040	mscorsvw.exe
1040	mscorsvw.exe
2632	mscorsvw.exe
2632	mscorsvw.exe
2336	mscorsvw.exe
2336	mscorsvw.exe
1408	mscorsvw.exe
1408	mscorsvw.exe
1652	mscorsvw.exe
1652	mscorsvw.exe
1872	mscorsvw.exe
1872	mscorsvw.exe
1744	mscorsvw.exe
1744	mscorsvw.exe
2964	mscorsvw.exe
2964	mscorsvw.exe
1676	mscorsvw.exe
1676	mscorsvw.exe
2880	mscorsvw.exe
2880	mscorsvw.exe
2776	mscorsvw.exe
2776	mscorsvw.exe
844	mscorsvw.exe
844	mscorsvw.exe
820	mscorsvw.exe
820	mscorsvw.exe
2592	mscorsvw.exe
2592	mscorsvw.exe
2164	mscorsvw.exe
2164	mscorsvw.exe
1936	mscorsvw.exe
1936	mscorsvw.exe
1548	mscorsvw.exe
1548	mscorsvw.exe
2208	mscorsvw.exe
2208	mscorsvw.exe
1684	mscorsvw.exe
1684	mscorsvw.exe
2120	mscorsvw.exe
2120	mscorsvw.exe
696	mscorsvw.exe
696	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1488793075-819845221-1497111674-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1488793075-819845221-1497111674-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\I:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\R:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\T:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\W:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\G:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\J:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\K:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\L:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\M:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\Q:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\Y:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\V:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\X:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\N:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\Z:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\H:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\U:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\S:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\O:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\P:	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\SysWOW64\mkkeplop.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\fjjgqond.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\system32\cdcepckm.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File created	\??\c:\windows\system32\jnijbiba.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\SysWOW64\mnlqcmaj.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\system32\fkancbio.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\SysWOW64\pdjnedfb.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File created	\??\c:\windows\system32\wbem\fpjoijef.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\system32\aodbnbbd.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File created	\??\c:\windows\system32\ogofopbb.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\system32\finknfon.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\system32\akadgpkq.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\system32\cflhiioj.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File created	\??\c:\windows\system32\aaokogep.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\windows\system32\hcoppcej.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dgilkpmn.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\iibndipn.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Internet Explorer\onnmbqjl.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\gdaoemja.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ckillgah.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Google\Chrome\Application\bhlnifll.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\7-Zip\nnknaeep.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\eqiodbdg.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\jnmgdhpg.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Internet Explorer\dbepndgm.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\llopmkim.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kefbfhkg.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ighnagcm.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\cpkcoelj.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File created	C:\Program Files\Internet Explorer\aglddoil.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\7-Zip\nklemblo.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hpbanfjo.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\gmoggjie.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP2BA2.tmp\Microsoft.Office.Tools.Word.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPD28B.tmp\stdole.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA67C.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF0A6.tmp\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	\??\c:\windows\ehome\lolifldb.tmp	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPBC5D.tmp\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9F99.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1E2B.tmp\Microsoft.Office.Tools.Excel.v9.0.dll	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe
2236	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2792	JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe
Token: SeShutdownPrivilege	2236	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 968	2236	mscorsvw.exe	38
PID 2236 wrote to memory of 968	2236	mscorsvw.exe	38
PID 2236 wrote to memory of 968	2236	mscorsvw.exe	38
PID 2236 wrote to memory of 1928	2236	mscorsvw.exe	39
PID 2236 wrote to memory of 1928	2236	mscorsvw.exe	39
PID 2236 wrote to memory of 1928	2236	mscorsvw.exe	39
PID 2236 wrote to memory of 2112	2236	mscorsvw.exe	41
PID 2236 wrote to memory of 2112	2236	mscorsvw.exe	41
PID 2236 wrote to memory of 2112	2236	mscorsvw.exe	41
PID 2236 wrote to memory of 2040	2236	mscorsvw.exe	42
PID 2236 wrote to memory of 2040	2236	mscorsvw.exe	42
PID 2236 wrote to memory of 2040	2236	mscorsvw.exe	42
PID 2236 wrote to memory of 108	2236	mscorsvw.exe	43
PID 2236 wrote to memory of 108	2236	mscorsvw.exe	43
PID 2236 wrote to memory of 108	2236	mscorsvw.exe	43
PID 2236 wrote to memory of 1552	2236	mscorsvw.exe	44
PID 2236 wrote to memory of 1552	2236	mscorsvw.exe	44
PID 2236 wrote to memory of 1552	2236	mscorsvw.exe	44
PID 2236 wrote to memory of 2096	2236	mscorsvw.exe	45
PID 2236 wrote to memory of 2096	2236	mscorsvw.exe	45
PID 2236 wrote to memory of 2096	2236	mscorsvw.exe	45
PID 2236 wrote to memory of 2296	2236	mscorsvw.exe	46
PID 2236 wrote to memory of 2296	2236	mscorsvw.exe	46
PID 2236 wrote to memory of 2296	2236	mscorsvw.exe	46
PID 2236 wrote to memory of 1640	2236	mscorsvw.exe	47
PID 2236 wrote to memory of 1640	2236	mscorsvw.exe	47
PID 2236 wrote to memory of 1640	2236	mscorsvw.exe	47
PID 2236 wrote to memory of 1792	2236	mscorsvw.exe	48
PID 2236 wrote to memory of 1792	2236	mscorsvw.exe	48
PID 2236 wrote to memory of 1792	2236	mscorsvw.exe	48
PID 2236 wrote to memory of 2592	2236	mscorsvw.exe	49
PID 2236 wrote to memory of 2592	2236	mscorsvw.exe	49
PID 2236 wrote to memory of 2592	2236	mscorsvw.exe	49
PID 2236 wrote to memory of 2104	2236	mscorsvw.exe	50
PID 2236 wrote to memory of 2104	2236	mscorsvw.exe	50
PID 2236 wrote to memory of 2104	2236	mscorsvw.exe	50
PID 2236 wrote to memory of 1040	2236	mscorsvw.exe	51
PID 2236 wrote to memory of 1040	2236	mscorsvw.exe	51
PID 2236 wrote to memory of 1040	2236	mscorsvw.exe	51
PID 2236 wrote to memory of 3008	2236	mscorsvw.exe	52
PID 2236 wrote to memory of 3008	2236	mscorsvw.exe	52
PID 2236 wrote to memory of 3008	2236	mscorsvw.exe	52
PID 2236 wrote to memory of 2632	2236	mscorsvw.exe	53
PID 2236 wrote to memory of 2632	2236	mscorsvw.exe	53
PID 2236 wrote to memory of 2632	2236	mscorsvw.exe	53
PID 2236 wrote to memory of 332	2236	mscorsvw.exe	54
PID 2236 wrote to memory of 332	2236	mscorsvw.exe	54
PID 2236 wrote to memory of 332	2236	mscorsvw.exe	54
PID 2236 wrote to memory of 2336	2236	mscorsvw.exe	55
PID 2236 wrote to memory of 2336	2236	mscorsvw.exe	55
PID 2236 wrote to memory of 2336	2236	mscorsvw.exe	55
PID 2236 wrote to memory of 1076	2236	mscorsvw.exe	56
PID 2236 wrote to memory of 1076	2236	mscorsvw.exe	56
PID 2236 wrote to memory of 1076	2236	mscorsvw.exe	56
PID 2236 wrote to memory of 1408	2236	mscorsvw.exe	57
PID 2236 wrote to memory of 1408	2236	mscorsvw.exe	57
PID 2236 wrote to memory of 1408	2236	mscorsvw.exe	57
PID 2236 wrote to memory of 2508	2236	mscorsvw.exe	58
PID 2236 wrote to memory of 2508	2236	mscorsvw.exe	58
PID 2236 wrote to memory of 2508	2236	mscorsvw.exe	58
PID 2236 wrote to memory of 1652	2236	mscorsvw.exe	59
PID 2236 wrote to memory of 1652	2236	mscorsvw.exe	59
PID 2236 wrote to memory of 1652	2236	mscorsvw.exe	59
PID 2236 wrote to memory of 1876	2236	mscorsvw.exe	60

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	mscorsvw.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c846c3f737167948ae219bcc5bf53c0.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 218 -NGENProcess 174 -Pipe 16c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 150 -InterruptEvent 178 -NGENProcess 1d8 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 25c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 24c -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 178 -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 268 -NGENProcess 150 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 184 -NGENProcess 150 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 274 -NGENProcess 1d8 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 268 -NGENProcess 27c -Pipe 184 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 1d8 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1d8 -NGENProcess 268 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 280 -NGENProcess 284 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 27c -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 28c -NGENProcess 1d8 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1d8 -NGENProcess 280 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 294 -NGENProcess 27c -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2336
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 28c -NGENProcess 29c -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 150 -NGENProcess 27c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 150 -InterruptEvent 27c -NGENProcess 298 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 27c -NGENProcess 150 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 150 -NGENProcess 214 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2ac -NGENProcess 254 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 254 -NGENProcess 27c -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 2b4 -NGENProcess 214 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 214 -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 2bc -NGENProcess 27c -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 27c -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 214 -NGENProcess 2a4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 2a4 -NGENProcess 248 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2d4 -NGENProcess 280 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 2cc -NGENProcess 248 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2e4 -NGENProcess 2a0 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2a0 -NGENProcess 214 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c8 -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2ec -NGENProcess 248 -Pipe 214 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f4 -NGENProcess 2a0 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d8 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 248 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2a0 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2f8 -NGENProcess 308 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 300 -NGENProcess 308 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 308 -NGENProcess 2f8 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 314 -NGENProcess 2d8 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 300 -NGENProcess 318 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 30c -NGENProcess 314 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 310 -NGENProcess 2c8 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 324 -NGENProcess 2a0 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2d8 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2c8 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2a0 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2d8 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2c8 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2a0 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 33c -NGENProcess 338 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:1032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 2a0 -NGENProcess 328 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 348 -NGENProcess 340 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 348 -NGENProcess 2a0 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:2332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 330 -NGENProcess 340 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:1600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 354 -NGENProcess 338 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:1708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 350 -NGENProcess 2a0 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 358 -NGENProcess 34c -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 2d0 -NGENProcess 338 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 35c -NGENProcess 330 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:1640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 364 -NGENProcess 34c -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 2a0 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:2980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 330 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 330 -NGENProcess 364 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 374 -NGENProcess 2a0 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 370 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 368 -NGENProcess 364 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 37c -NGENProcess 338 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 384 -NGENProcess 370 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 2a0 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 338 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 370 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:2632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 2a0 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 338 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:2472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 370 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 39c -NGENProcess 398 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:2352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 38c -NGENProcess 370 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3a8 -NGENProcess 394 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:2360
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 390 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:1736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 370 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 394 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:1968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 390 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:1032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 370 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3a8 -NGENProcess 394 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3b8 -NGENProcess 3a0 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:1288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3c8 -NGENProcess 3ac -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:1756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 370 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3a0 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3ac -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:2316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3c0 -NGENProcess 370 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:1416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 3d0 -NGENProcess 374 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d8 -NGENProcess 370 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3bc -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 374 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3d8 -NGENProcess 3e4 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 374 -NGENProcess 3c8 -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3c8 -NGENProcess 3cc -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3e8 -NGENProcess 3f0 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2120
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 3c8 -NGENProcess 3f0 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:1408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3f8 -NGENProcess 370 -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 3e0 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3e0 -NGENProcess 3c8 -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:1752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3ec -NGENProcess 2a4 -Pipe 1a4 -Comment "NGen Worker Process"
  2⤵
  PID:1600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 404 -NGENProcess 3f8 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 40c -NGENProcess 3c8 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:2540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 410 -NGENProcess 3cc -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 3f8 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 3c8 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:2616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3cc -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:3028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 424 -NGENProcess 3f8 -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 404 -NGENProcess 3e8 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 430 -NGENProcess 414 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 434 -NGENProcess 3f8 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:2104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 3e8 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:2564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2952

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ncjookla.tmp

Filesize
694KB

MD5
7efa6697fadb18d4d1aabeea2dc6e04d

SHA1
a5fa195aa82275cd082283e025c1edd2d6e22b85

SHA256
9d096223e41438b649f7703c19b1ab7b59e84001f712fb597492a572e5f8b471

SHA512
1f2784a122f662f8794beb5e3fe52acb3b6829f2130c3db2e8f48b5fc017638044bbe5246d3597deff4162208767fc24b19da6ba5308442f43f86636d62349d2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.6MB

MD5
e61ac64b87e07a2af611fbb42705047a

SHA1
3fc8b413e0fdcda14fa92947cf825ade37d67d5f

SHA256
8a1295a1eb1180aa785592ed711ee02e1a98550a7eb32b490011b5de1f27a48a

SHA512
c3df17929d55796537b8e7f31b0e2c85907bed05af998c064f85177ec31114b96db1f9bd44a857e11f7d0dbc0c32cd745180fba54fc50f04e8f95e3e62f3a7bb

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\odadaonc.tmp

Filesize
4.8MB

MD5
29f28fd1e77cbf257c4e9aa265676b11

SHA1
a567b70277a17cb4344f58d29c6685e8c0b339ac

SHA256
dc184471f723a62dbadf818b0621c0d905135c18627d20b0e3134ca3e8b49075

SHA512
a270b3d94733b462ce7fa27f5a9377c8974c0ec1d2e254dc5ecd35217e1fdedbb2a99f51cdf58fd98715f3578d44c1b66c23e5d45a28c4d3da351c1819010ee8

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
bf89a560abb141f65995e747676d72e7

SHA1
9180f042a56ea11ae70d08068752eaf345b7a7e8

SHA256
99aa22f971caec0a50c806f020ee469d7087909c759722d1d72f01be4b773058

SHA512
3f218e31aeb18770628c0fac5828d42d5ea84e4d4126033f0ae23cedfa424bf0ff9da4040eeefe0948a307c2e4f3c629ebae10d1eaff82b3e8d23f82bf206f35

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
dc31397f9548a96620c1cc70efe79ac8

SHA1
1d4132e186e808aed60d2fb7799cdba2fa0a32d9

SHA256
4ea27d5d1259403b838f1061bed937ad55e65e8413594e9a8ceb882e96a3ce0a

SHA512
e5be6119bcda2b259f5c078d26ede6f19fca2906cddc17e0aa65ef3a518aaa88d3a0e4e411acb355053da79197e7c5f4cd1a0be098123ca205ca8892fc762bf5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
c469ec0ded00c4e91bde3dcaa1c44e65

SHA1
f86a793535dd95933f85634d8f8ceecbee2fe4cc

SHA256
3d859e40f7627ded415d7b494f50cb56bc45b294f4c711e942c56e33c3613d65

SHA512
36a747ffb0887b97cdf4a90e707f8e37d784a766eefc7eb2974d7bb8f5b49432ee856e2175046115b0cbab593b26c7ba9a6c7044b1af583eed092fe21b5cbaff

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
08f0deb44a8be59e45670daf50a17f4c

SHA1
d75fef9095fc25fd7d211c091bbc34b6306979c2

SHA256
5e517ecd5403f193463ceb240b5159e4703c09b3a1851d47dd35aa96686b53a8

SHA512
b71916fd6dc41cb3855eeb561cb56961b27f354e58bd04004b9f42c62e46b5a099822e74855f338d4dde7aa4e17c3aba2feba312598325054c7b87a788989709

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
d9cc8faedc682b7db96bd1b7dcc7e09e

SHA1
52b7aaf20e7ff907c1d3315861aa51fa12029aa1

SHA256
64a9bd25c65b76a920f39180cfd7dd1bfc86a6b030d77cab788220b0d128b393

SHA512
92a4e18067d11df489838d6a8c44d9aa510c006ceb8b5d673e6c67616586267477d14fae237c33a3c35e0961b5f7ec6b57923bed1a7a62f789b48c665043ae08

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
613KB

MD5
343bb752173f6dd78e86790496ba77f7

SHA1
6cd6909e8e30871e910aee69a1b22253295a027a

SHA256
6767b1732b835f61b1f7724696b25f26d62b96ad56c6f7aa7ee050dabb1e5ee1

SHA512
462301e34d382f75209ea7a73ab4b56acbb9591a901d5152793885c961d5ea504588168be67744067e6c871ddddf5d5d75f54fe7f55026ac5d761cc9d580ac61

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
4f8e329afa2a50aa1fd594b3d3f18063

SHA1
8622a440d48b7b845ff47c4cd4e7d50d23e4aef6

SHA256
44e11b3980cad307e2a0120c2b8fc378fb9d0a2b054dc2fc2f868b89cec865b3

SHA512
6718cfdd35ddb5b1fd63dd6643980d8ec4590afd245fd73010226ca5bd364865ed6973e946c3847288ad18d2e2fc0d1fbc2ec355db54b5dec52c401bc17f7c4c

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
644KB

MD5
1ae496d7844a6fb073918252a0c7c601

SHA1
b98c7fd76b80ad97757ad8d4764c07d286148ff2

SHA256
df23e51191546ffedc63ec3aef58c6d46744b5903dff056cd61b0008db21d172

SHA512
6c2ecd8a937cc7ba56118d30f3fff1010ac9f99ed640bad4895b9d4c50c89cbe29fb2e281511785e1a01835fe2832e63c2a764bd6fa473638e9b1482c858a176

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
666KB

MD5
7fd6a4e444f66db818b579b4853422e8

SHA1
3023974882d83df5bf29fa64f14fd314230d2d99

SHA256
f746de47de8b216e6dd2eb81e9a9fef04c97d31214fd4208e6c0d0dc905324b9

SHA512
4a0d42262c2f69f1ebb19513cd632589eb8fd7409f4e46795f60e47696222d701a1767f28aaebb17ca2d4467ecb5e8bef071817980780bc7e4be603794568afb

Download Submit
C:\Windows\Temp\Cab170A.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar190E.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\69f8a058c24a65c205b36f14cad86c7c\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
e4c8a0905438ec0c5c9775344eac9ca0

SHA1
c1d982672b99ad5f952f49d6090296c55f212b86

SHA256
67f9e0d8f0303d833f6f72b540edb8c2467346949f2469cf956aa634ac733e6b

SHA512
bc1a21def742815bc5ccf95a9376cc5234c52340bbfe15b8d017736057c6f0835ad92d2f9038f33238819ceda8cca6761dc96aea0f14ede5ad1dbc3bbc5402e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8ae94640279c29a8040a5926cd26d7f8\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
2f9d52fe714b56d641f0949c166be7a8

SHA1
16fb4670c84ac83ceafb9765f67fcffce4fc7ddd

SHA256
cdbee5c335811b981954a3c88af83efbbc0aa2cd8ba86ee22fc02a0b7f20f507

SHA512
18034c51281c5b03524697cd138a82a94639801d596e219016b58b56ceaf49fb239a3e00e41585ea35ddb16bff31c9a026b4e73e798a18c44990c30683b18093

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\c30bef87c99026550a7f5ff2806340f3\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
5873a3e19ccec9871d4aa1d251739e17

SHA1
9dc888e9618ec3fc839dc6693b7059dd5a68972d

SHA256
1fc12906f96dfedc31c9cc2b83f3e3e4c51238ba5d3b9defcd81c0a5031972b2

SHA512
9d7be3641a1c72e4019de044ae984edfca1d5123bc09ae4e0db7f44e1b872645cd84043026fe7b30e143142febee83e666c9ba8fbe119aaf6cd26c4a37ce5a7c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\cc1ea6d8c5681c9226b29c013abd9272\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
afc9888bb8519b868fe2e9c40928640d

SHA1
3a6cb0aa172fffc39aafd8f5630fb76f1b023bd5

SHA256
62569d3211c001ea7df90eb30cf9280dda0f19797c4fb724f257ef253bae748c

SHA512
de10303661d95205a4384e1d80a28f50ce676b0192e2b50e315456fee7f582b4bb33eb92ed302420cb0bdfbedbde796cba7441b3332b445f0f49bbb6b15e8d2f

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
694KB

MD5
592ab9aca6ac0edcf5d82e18ca70a437

SHA1
56e033a458a090dc785acfbc8afb27a7c10b0d94

SHA256
9c4dfdac7890fd4c87b621707ceccf438075ba56d9e63b6c7efa322a3a86f4f2

SHA512
62bfa493ad686fad6d0c99103e8aeb0a4d575aceb3e6a1a9ed92214b468123fe93138d4e6887580af13a303f62898cba62e00eb8bf5edc71099890f0675fb2b1

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
553378bed3ef4dbec0c184c313cb7b49

SHA1
642401af20712165ea1ca4c9ad0d5e8f7383ca99

SHA256
5147e46c4a0da995a5353553a0c02eb265d5dee21f36cd9cc1ec468687239c1e

SHA512
d2a440350a12706953c7807ef96a15f302e597db31bfc66ddc57cb7be10b240ebbd32c46a2fa30c839d4e97431c53e489159e0fd0681a2c2f51603dead9aa1c3

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
773KB

MD5
2b294bc1f03c7e0be05b9871deed1060

SHA1
e86c8cb00a8bd8d18f7b4dc387d15c1ff2f64dc6

SHA256
db2724a353b7946e884f578bbc6fda06e3ebb0931cc847913858a0398b2c45dc

SHA512
88c1dcea7793a3f01cc6211cb721435c40021eb55ff6ceca1537674012ce644f126cbc42e86270b2e4dddadf10791b5e614f0b86faa162d99504bc835ede6e3d

Download Submit
\??\c:\program files\windows media player\wmpnetwk.exe

Filesize
2.0MB

MD5
2cd78887f3e5ea279564636bc2f438a2

SHA1
c9cf8e22beee462989597e6f662b13bce48d6333

SHA256
9c29492bffd3934f7621728ea6908b28750c8b7a1074cae617f0ee4b864f38d5

SHA512
4fbeed273c490b1686d585f466a87773b54f5153eb4a2e1e045f7adcea50eb5dbf91398cd9295e8125129b17ca9fe47887c34cb55609a66e49354fb1f32a2b09

Download Submit
\??\c:\windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
1ffee2c8cc89144c6993161c4667a018

SHA1
8702e9ca7a2a226e51f9abfdfb67e0857087a96c

SHA256
748636db584fcba3a044fbecbf46475125b05366c809657842fe312d3c2e8c5c

SHA512
04776f86e3650022884b0f79e0f6466371e6ed70c946037327ac6ed08a8a2ac8edb7be69ca06ccb2a838b14be7389f2ac4cb79fe5249f310a701ce1a10b9b77f

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
679KB

MD5
2f6484fedb3084ceb5ee7268a79fe765

SHA1
32eb5981fe1db3b2faa74dc183750534023a99e6

SHA256
2ceadbc43fcb174114a4b290b3d18b8b3fcc1886928cda603cd8f01eea3e8bc1

SHA512
6cab2a81e12f56b3ce1bf1ba40b0398d459734637cf6c2ee8ccb30c114b390f6ea9b012e62ff7fb43f4985d83e5fc5fe4803a76ed00a406fd6b90c1f8138bfda

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
591KB

MD5
db59d247308b1eabe84ef836fcc8d5f8

SHA1
1cfe0902816b65482b272997c03ceb262415025d

SHA256
be0d04e87581f8dbfbef6ba3b2485eff3389b857f966a45df22dfa719a40212a

SHA512
1478fd349ca63d966ff1f1e31571b492441f8397aace76ba596e126cf9d37d8dd838808049d15dbbc6086c1f552dc2d938fd2ad515684f2c880099a94d1afd74

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
632KB

MD5
bd5049f7b9cc136ccf127d16a0300af2

SHA1
9581ab7fa13a19414938b8bae03a21d87e44671a

SHA256
beb89cac8deb43850afad56457a0947f4329d8c6af4a98a0dd6fae30a4189ab4

SHA512
f249cb96522581fa8f49c8cc61df2ebb3f001c21140c22d92b94491c1cffd999a69b7baca71503a9e9b9c23f71b20c5486e80cf8c630e3b69d4696820c6b3b5a

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
d1d57f1fbb6013045ac2214295cfeb65

SHA1
77356987dfa8e5a50b25ee4151745c152649e982

SHA256
7d65d470409221034cf88e0ec3ef05c15879687d54727689b6d19b6d490de631

SHA512
e465a8505672ad4c2a14916f31b85681e0bea491762d41b5cd08d9dd0b30dff662981d4faaca3a0e0d0987575de047c4ab72cb88794dd1b0fdb9a8914fa1b8aa

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
693KB

MD5
8c93c9ad6750fc84c05b120dd08c13ec

SHA1
b65ec1d36d1c8be382f7aa68238f33e56c54f22a

SHA256
0cf83745bfbc3daaf18fb90602d80fada37610d980ac5fed4f388ba4bd905459

SHA512
8d9f326cfae9097e3caa266162999ed914f161cfa61aa34ce13017441e5cdd758ba122962d8e402003dde5d0ef4805321fadff4fa2184a181f4353ad104cf023

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
683KB

MD5
ccfa3f56d811a4ce50d8179e967593bd

SHA1
d478c85296e8fe45f13179034011c9ed54dfcf51

SHA256
e310303c9a3d1d30e2b434dde4f3ee10f40b6e50fb4d2ee7bd8d83a23bda9ad3

SHA512
c142c64e52ef267f3206c2e68589a73e4d8c707f8a1213afb324822275c69b290a72e625b69b22892224555c5101fa69c716c2cad092170089f9cf22d08d122b

Download Submit
\??\c:\windows\system32\searchindexer.exe

Filesize
1.1MB

MD5
662239edb47a19751c65f93837e23232

SHA1
71c41d5bc550a04089b7bc34f6f7c82ff3250bd4

SHA256
a38d0b97a970a37c0aff5176414c602707855797c989284abdd2a98423231034

SHA512
50b44475538c85603abe746aad84947e0bee3b24f2ebac27d76cd43784097bb32e171b9daf018cc43dfebfdbd629276f36c6780137ab819f0acf2ce013897ac2

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
569KB

MD5
45fddfb40680035a465c388f5df37190

SHA1
b84fdab830165eba21a0e07f27e7238529747c16

SHA256
abde935f708ae18537fb9fc52cfcae48ed83bfe134553ba9398418ae2cecb9ca

SHA512
4cdbe8cdf1a52ddd00872c89abfa19cec9ac46ef0267236c6a1e05c720f0efeab79236290a04cf3dd5bdae25cc7d196e78c41b0934301478229258f042df9a65

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
595KB

MD5
e26c09909c93ce7709ceeb37e09837a6

SHA1
c1947d7ff0c1201913374f51aebef3f80e888b2e

SHA256
076adb0d3e8ec0d611814af502226fd50eedc388c7bf799c4bc8afbcf8610614

SHA512
8124bc954483eedcff46b0e8466dd8ff714d5e0e71e653faf17ba5c265bd7612d33ab8272e65d5b1f1b30b8ea512e6fdf6825eea324fc3a7fbbe7427225268f0

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.1MB

MD5
67d531d0889e0ecb1efdeb0b3a745fe0

SHA1
eca9e5e7df722faafe2025b464ff63d97dccade4

SHA256
12d6a724ed021ad7f7cffccdd3eabd98340828c3cf6009eb9ee57be6cb09fd8c

SHA512
1c12e39e0e7c49d6b9bb0d00c145517d8a3fba52c5db690e70bc77ac53c33727a02062b470148cf92346d3b7bd5ad87bdf5ab37e89d9770d344e6229740ecc66

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.1MB

MD5
b6e5623989baba7b1ddefae6ec23ea57

SHA1
8d801dfdd2f9d5d9f2fd429cd0e840536cd036ec

SHA256
4412f4432cf7f8be28fe2f840efa21534c309c5a5ea48033586bd53f7c5ea13a

SHA512
495fd124f46047b17cd0e0bf42427cef87b646618599b313792b6d6189efcfdbf240fa88c2d58d4a6d1e7f5a1c89a3f40e47c1c0a1cea108cd46765b818342fc

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
753KB

MD5
0371de7fe198df822daab23bfe99d7cf

SHA1
548a3344b20e4a5d7572f819fa618a8f153cfa6e

SHA256
c28d7e2d870680fb633f1b2ad5822c781c370539373cbb2e4ab67b0afeae6a23

SHA512
9bd4cbe45f2969aa95421d880c9a31d7f0382ad5b749e19965f0aade5e0a5a227aa344228482ef6ac1b9077d5e0553c7e019dc39abd6d9548359ebfccd1068b5

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.0MB

MD5
887a79d4282d3d0562f8c9494dec9ff6

SHA1
8160a5d1176e46079741e3869205fdfd686b009a

SHA256
996e7bbcb11b07d768446400ccd7f182f4f88508e8a703a6c47d7cf0b68b2445

SHA512
90ed57db8c375cc6f5d46269bf938153720f68927eb4f91519dbde8dc82a63a4294ddf3cdb341c2b5c90afb67effea7467cdfec68608b8b1c07a67512aa52959

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
640KB

MD5
6657e12c79b822c0269a3b4d62902469

SHA1
c1cc83d9deb363a387998a81a11699f191a15620

SHA256
392ea39572705dea35fa7beab1d11530f00115089e0f4b87aedfa8f729249e62

SHA512
063089e81da8c3ad1a5135277c70fe303774fe9bcb49f50486bfdb2858e87bdbfb04d1f97aff9e5ec245ae5f4ebb0274ce6e84d3ac29e20223c8361dc1dbe3ad

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9C7E.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9F99.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA370.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA67C.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA93A.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
memory/108-336-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/108-332-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/332-469-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/332-471-0x00000000007C0000-0x00000000007CE000-memory.dmp

Filesize
56KB

Download
memory/332-473-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/968-161-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/968-186-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1040-448-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1040-439-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/1040-438-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/1040-434-0x000000001C540000-0x000000001C554000-memory.dmp

Filesize
80KB

Download
memory/1040-432-0x0000000000790000-0x000000000079C000-memory.dmp

Filesize
48KB

Download
memory/1040-433-0x00000000030C0000-0x00000000030CC000-memory.dmp

Filesize
48KB

Download
memory/1076-486-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1408-489-0x000000001C530000-0x000000001C546000-memory.dmp

Filesize
88KB

Download
memory/1408-497-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1552-342-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1552-340-0x0000000000820000-0x0000000000836000-memory.dmp

Filesize
88KB

Download
memory/1552-339-0x0000000002FE0000-0x0000000003028000-memory.dmp

Filesize
288KB

Download
memory/1552-338-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1552-337-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/1552-335-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1640-373-0x000000001C4B0000-0x000000001C4C6000-memory.dmp

Filesize
88KB

Download
memory/1640-376-0x000000001CA10000-0x000000001CA2E000-memory.dmp

Filesize
120KB

Download
memory/1640-370-0x00000000030B0000-0x00000000030C8000-memory.dmp

Filesize
96KB

Download
memory/1640-383-0x000000001D160000-0x000000001D178000-memory.dmp

Filesize
96KB

Download
memory/1640-384-0x000000001D160000-0x000000001D178000-memory.dmp

Filesize
96KB

Download
memory/1640-371-0x0000000003120000-0x000000000312C000-memory.dmp

Filesize
48KB

Download
memory/1640-374-0x000000001C4D0000-0x000000001C518000-memory.dmp

Filesize
288KB

Download
memory/1640-394-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1640-375-0x000000001C520000-0x000000001C53A000-memory.dmp

Filesize
104KB

Download
memory/1640-372-0x0000000003130000-0x000000000313E000-memory.dmp

Filesize
56KB

Download
memory/1652-499-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1792-401-0x00000000031B0000-0x00000000031C0000-memory.dmp

Filesize
64KB

Download
memory/1792-393-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1792-399-0x0000000000680000-0x000000000068C000-memory.dmp

Filesize
48KB

Download
memory/1792-403-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1928-187-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1928-185-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2040-333-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2096-361-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2096-347-0x000000001C4C0000-0x000000001C4D6000-memory.dmp

Filesize
88KB

Download
memory/2096-346-0x000000001C470000-0x000000001C4B8000-memory.dmp

Filesize
288KB

Download
memory/2096-344-0x000000001C100000-0x000000001C10E000-memory.dmp

Filesize
56KB

Download
memory/2096-345-0x000000001C460000-0x000000001C46C000-memory.dmp

Filesize
48KB

Download
memory/2096-352-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2096-351-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2104-428-0x0000000003160000-0x0000000003174000-memory.dmp

Filesize
80KB

Download
memory/2104-426-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2104-427-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/2104-430-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2112-330-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2236-58-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2236-162-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2276-46-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/2296-366-0x00000000032E0000-0x00000000032FE000-memory.dmp

Filesize
120KB

Download
memory/2296-364-0x0000000000820000-0x000000000082E000-memory.dmp

Filesize
56KB

Download
memory/2296-365-0x00000000008C0000-0x00000000008DA000-memory.dmp

Filesize
104KB

Download
memory/2296-362-0x00000000007B0000-0x00000000007C8000-memory.dmp

Filesize
96KB

Download
memory/2296-368-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2336-485-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2336-477-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2336-475-0x0000000003020000-0x000000000302E000-memory.dmp

Filesize
56KB

Download
memory/2508-498-0x00000000008C0000-0x00000000008CA000-memory.dmp

Filesize
40KB

Download
memory/2584-55-0x0000000010000000-0x000000001028B000-memory.dmp

Filesize
2.5MB

Download
memory/2584-36-0x0000000010000000-0x000000001028B000-memory.dmp

Filesize
2.5MB

Download
memory/2584-35-0x0000000010000000-0x000000001028B000-memory.dmp

Filesize
2.5MB

Download
memory/2592-415-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2592-425-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2592-406-0x0000000003240000-0x000000000324C000-memory.dmp

Filesize
48KB

Download
memory/2592-405-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2592-416-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2592-407-0x0000000003250000-0x000000000325E000-memory.dmp

Filesize
56KB

Download
memory/2592-411-0x0000000003280000-0x0000000003290000-memory.dmp

Filesize
64KB

Download
memory/2592-410-0x000000001C530000-0x000000001C54A000-memory.dmp

Filesize
104KB

Download
memory/2592-409-0x000000001C4E0000-0x000000001C528000-memory.dmp

Filesize
288KB

Download
memory/2592-408-0x0000000003260000-0x0000000003276000-memory.dmp

Filesize
88KB

Download
memory/2632-470-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2632-455-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/2632-454-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/2632-459-0x00000000032B0000-0x00000000032CA000-memory.dmp

Filesize
104KB

Download
memory/2632-460-0x00000000032B0000-0x00000000032CA000-memory.dmp

Filesize
104KB

Download
memory/2792-1-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/2792-0-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2792-2-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2820-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2820-54-0x0000000010000000-0x0000000010258000-memory.dmp

Filesize
2.3MB

Download
memory/2820-21-0x0000000010000000-0x0000000010258000-memory.dmp

Filesize
2.3MB

Download
memory/2824-175-0x0000000140000000-0x0000000140292000-memory.dmp

Filesize
2.6MB

Download
memory/2824-92-0x0000000140000000-0x0000000140292000-memory.dmp

Filesize
2.6MB

Download
memory/2824-244-0x0000000140000000-0x0000000140292000-memory.dmp

Filesize
2.6MB

Download
memory/2952-170-0x0000000140000000-0x000000014041B000-memory.dmp

Filesize
4.1MB

Download
memory/2952-85-0x0000000140000000-0x000000014041B000-memory.dmp

Filesize
4.1MB

Download
memory/3008-450-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/3008-449-0x00000000007C0000-0x00000000007DA000-memory.dmp

Filesize
104KB

Download
memory/3008-452-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download