expiro | d48a5782e88fa2e4e12fa713548ed3d52bb0796f9cacbbacd4ea74c669226236

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
Size

843KB
MD5

78be830fb6eab0c7e9a190dce8578aec
SHA1

ee2768f6affa6b067200d06c6a29c34b5cb977f9
SHA256

d48a5782e88fa2e4e12fa713548ed3d52bb0796f9cacbbacd4ea74c669226236
SHA512

9af940812a65e12f77d21de7e5c25f27b2f978e7198c007a4c1482a59822212cdbc14f872c910b0db286b1f6bfcb0d109ff40d54c02768f97ef9052fb6b8f194
SSDEEP

24576:Km+C3OkIqxwJV9tTF694LWj1c5tibz4mhns:KA1x8V9tBpftcF

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2312-2-0x0000000001000000-0x00000000011EF000-memory.dmp	family_expiro1
behavioral1/memory/2804-54-0x0000000010000000-0x00000000101A9000-memory.dmp	family_expiro1

Executes dropped EXE 64 IoCs

pid	Process
2804	mscorsvw.exe
476	Process not Found
2660	mscorsvw.exe
2848	mscorsvw.exe
2620	mscorsvw.exe
760	elevation_service.exe
1424	IEEtwCollector.exe
1136	mscorsvw.exe
940	mscorsvw.exe
2964	mscorsvw.exe
2384	mscorsvw.exe
2368	mscorsvw.exe
1724	mscorsvw.exe
1380	mscorsvw.exe
2392	mscorsvw.exe
2376	mscorsvw.exe
1712	mscorsvw.exe
2196	mscorsvw.exe
1496	mscorsvw.exe
2672	mscorsvw.exe
2824	mscorsvw.exe
2592	mscorsvw.exe
316	mscorsvw.exe
2024	mscorsvw.exe
1076	mscorsvw.exe
2724	mscorsvw.exe
972	mscorsvw.exe
2632	mscorsvw.exe
1388	mscorsvw.exe
1008	mscorsvw.exe
872	mscorsvw.exe
2888	mscorsvw.exe
1608	mscorsvw.exe
2168	mscorsvw.exe
2504	mscorsvw.exe
2148	mscorsvw.exe
3000	mscorsvw.exe
2844	mscorsvw.exe
2760	mscorsvw.exe
2248	mscorsvw.exe
1076	mscorsvw.exe
560	mscorsvw.exe
1732	mscorsvw.exe
308	mscorsvw.exe
2324	mscorsvw.exe
2700	mscorsvw.exe
1804	mscorsvw.exe
3040	mscorsvw.exe
2784	mscorsvw.exe
2056	mscorsvw.exe
1216	mscorsvw.exe
2880	mscorsvw.exe
1252	mscorsvw.exe
1612	mscorsvw.exe
2356	mscorsvw.exe
1740	mscorsvw.exe
1616	mscorsvw.exe
2112	mscorsvw.exe
1692	mscorsvw.exe
1592	mscorsvw.exe
2380	mscorsvw.exe
2996	mscorsvw.exe
528	mscorsvw.exe
2332	mscorsvw.exe

Loads dropped DLL 52 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
1380	mscorsvw.exe
1380	mscorsvw.exe
2376	mscorsvw.exe
2376	mscorsvw.exe
2196	mscorsvw.exe
2196	mscorsvw.exe
2672	mscorsvw.exe
2672	mscorsvw.exe
2592	mscorsvw.exe
2592	mscorsvw.exe
2024	mscorsvw.exe
2024	mscorsvw.exe
2724	mscorsvw.exe
2724	mscorsvw.exe
2632	mscorsvw.exe
2632	mscorsvw.exe
1008	mscorsvw.exe
1008	mscorsvw.exe
2888	mscorsvw.exe
2888	mscorsvw.exe
2168	mscorsvw.exe
2168	mscorsvw.exe
2148	mscorsvw.exe
2148	mscorsvw.exe
2844	mscorsvw.exe
2844	mscorsvw.exe
2248	mscorsvw.exe
2248	mscorsvw.exe
560	mscorsvw.exe
560	mscorsvw.exe
308	mscorsvw.exe
308	mscorsvw.exe
2056	mscorsvw.exe
2056	mscorsvw.exe
1216	mscorsvw.exe
1216	mscorsvw.exe
1252	mscorsvw.exe
1252	mscorsvw.exe
1816	mscorsvw.exe
1816	mscorsvw.exe
2820	mscorsvw.exe
2820	mscorsvw.exe
2776	mscorsvw.exe
2776	mscorsvw.exe
980	mscorsvw.exe
980	mscorsvw.exe
1600	mscorsvw.exe
1600	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1846800975-3917212583-2893086201-1000	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1846800975-3917212583-2893086201-1000\EnableNotifications = "0"	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	elevation_service.exe
File opened (read-only)	\??\J:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\K:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\Y:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\K:	elevation_service.exe
File opened (read-only)	\??\V:	elevation_service.exe
File opened (read-only)	\??\X:	elevation_service.exe
File opened (read-only)	\??\E:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\M:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\Q:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\V:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\G:	elevation_service.exe
File opened (read-only)	\??\I:	elevation_service.exe
File opened (read-only)	\??\Q:	elevation_service.exe
File opened (read-only)	\??\S:	elevation_service.exe
File opened (read-only)	\??\Y:	elevation_service.exe
File opened (read-only)	\??\I:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\N:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\E:	elevation_service.exe
File opened (read-only)	\??\L:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\J:	elevation_service.exe
File opened (read-only)	\??\L:	elevation_service.exe
File opened (read-only)	\??\O:	elevation_service.exe
File opened (read-only)	\??\U:	elevation_service.exe
File opened (read-only)	\??\O:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\P:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\X:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\H:	elevation_service.exe
File opened (read-only)	\??\M:	elevation_service.exe
File opened (read-only)	\??\R:	elevation_service.exe
File opened (read-only)	\??\T:	elevation_service.exe
File opened (read-only)	\??\W:	elevation_service.exe
File opened (read-only)	\??\Z:	elevation_service.exe
File opened (read-only)	\??\G:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\R:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\W:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\Z:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\N:	elevation_service.exe
File opened (read-only)	\??\H:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\S:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\T:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened (read-only)	\??\U:	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\ui0detect.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\alg.exe	elevation_service.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\locator.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\vds.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	elevation_service.exe
File created	\??\c:\windows\system32\alg.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	elevation_service.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\msdtc.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\system32\vssvc.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	elevation_service.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Internet Explorer\iexplore.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\7-Zip\7zG.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Internet Explorer\ieinstal.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\7-Zip\7zFM.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	elevation_service.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP86AD.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPC4B6.tmp\ehiVidCtl.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	elevation_service.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8A84.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP21F2.tmp\Microsoft.Office.Tools.Word.v9.0.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9A1D.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1C95.tmp\Microsoft.Office.Tools.Outlook.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	elevation_service.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	elevation_service.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA0C2.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe
760	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2312	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	760	elevation_service.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe
Token: SeShutdownPrivilege	2620	mscorsvw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2312	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
2312	JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 1136	2620	mscorsvw.exe	40
PID 2620 wrote to memory of 1136	2620	mscorsvw.exe	40
PID 2620 wrote to memory of 1136	2620	mscorsvw.exe	40
PID 2620 wrote to memory of 940	2620	mscorsvw.exe	41
PID 2620 wrote to memory of 940	2620	mscorsvw.exe	41
PID 2620 wrote to memory of 940	2620	mscorsvw.exe	41
PID 2620 wrote to memory of 2964	2620	mscorsvw.exe	43
PID 2620 wrote to memory of 2964	2620	mscorsvw.exe	43
PID 2620 wrote to memory of 2964	2620	mscorsvw.exe	43
PID 2620 wrote to memory of 2384	2620	mscorsvw.exe	44
PID 2620 wrote to memory of 2384	2620	mscorsvw.exe	44
PID 2620 wrote to memory of 2384	2620	mscorsvw.exe	44
PID 2620 wrote to memory of 2368	2620	mscorsvw.exe	45
PID 2620 wrote to memory of 2368	2620	mscorsvw.exe	45
PID 2620 wrote to memory of 2368	2620	mscorsvw.exe	45
PID 2620 wrote to memory of 1724	2620	mscorsvw.exe	46
PID 2620 wrote to memory of 1724	2620	mscorsvw.exe	46
PID 2620 wrote to memory of 1724	2620	mscorsvw.exe	46
PID 2620 wrote to memory of 1380	2620	mscorsvw.exe	47
PID 2620 wrote to memory of 1380	2620	mscorsvw.exe	47
PID 2620 wrote to memory of 1380	2620	mscorsvw.exe	47
PID 2620 wrote to memory of 2392	2620	mscorsvw.exe	48
PID 2620 wrote to memory of 2392	2620	mscorsvw.exe	48
PID 2620 wrote to memory of 2392	2620	mscorsvw.exe	48
PID 2620 wrote to memory of 2376	2620	mscorsvw.exe	49
PID 2620 wrote to memory of 2376	2620	mscorsvw.exe	49
PID 2620 wrote to memory of 2376	2620	mscorsvw.exe	49
PID 2620 wrote to memory of 1712	2620	mscorsvw.exe	50
PID 2620 wrote to memory of 1712	2620	mscorsvw.exe	50
PID 2620 wrote to memory of 1712	2620	mscorsvw.exe	50
PID 2620 wrote to memory of 2196	2620	mscorsvw.exe	51
PID 2620 wrote to memory of 2196	2620	mscorsvw.exe	51
PID 2620 wrote to memory of 2196	2620	mscorsvw.exe	51
PID 2620 wrote to memory of 1496	2620	mscorsvw.exe	52
PID 2620 wrote to memory of 1496	2620	mscorsvw.exe	52
PID 2620 wrote to memory of 1496	2620	mscorsvw.exe	52
PID 2620 wrote to memory of 2672	2620	mscorsvw.exe	53
PID 2620 wrote to memory of 2672	2620	mscorsvw.exe	53
PID 2620 wrote to memory of 2672	2620	mscorsvw.exe	53
PID 2620 wrote to memory of 2824	2620	mscorsvw.exe	54
PID 2620 wrote to memory of 2824	2620	mscorsvw.exe	54
PID 2620 wrote to memory of 2824	2620	mscorsvw.exe	54
PID 2620 wrote to memory of 2592	2620	mscorsvw.exe	55
PID 2620 wrote to memory of 2592	2620	mscorsvw.exe	55
PID 2620 wrote to memory of 2592	2620	mscorsvw.exe	55
PID 2620 wrote to memory of 316	2620	mscorsvw.exe	56
PID 2620 wrote to memory of 316	2620	mscorsvw.exe	56
PID 2620 wrote to memory of 316	2620	mscorsvw.exe	56
PID 2620 wrote to memory of 2024	2620	mscorsvw.exe	57
PID 2620 wrote to memory of 2024	2620	mscorsvw.exe	57
PID 2620 wrote to memory of 2024	2620	mscorsvw.exe	57
PID 2620 wrote to memory of 1076	2620	mscorsvw.exe	58
PID 2620 wrote to memory of 1076	2620	mscorsvw.exe	58
PID 2620 wrote to memory of 1076	2620	mscorsvw.exe	58
PID 2620 wrote to memory of 2724	2620	mscorsvw.exe	59
PID 2620 wrote to memory of 2724	2620	mscorsvw.exe	59
PID 2620 wrote to memory of 2724	2620	mscorsvw.exe	59
PID 2620 wrote to memory of 972	2620	mscorsvw.exe	60
PID 2620 wrote to memory of 972	2620	mscorsvw.exe	60
PID 2620 wrote to memory of 972	2620	mscorsvw.exe	60
PID 2620 wrote to memory of 2632	2620	mscorsvw.exe	61
PID 2620 wrote to memory of 2632	2620	mscorsvw.exe	61
PID 2620 wrote to memory of 2632	2620	mscorsvw.exe	61
PID 2620 wrote to memory of 1388	2620	mscorsvw.exe	62

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78be830fb6eab0c7e9a190dce8578aec.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2312

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 164 -NGENProcess 168 -Pipe 174 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 164 -NGENProcess 168 -Pipe 178 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 160 -InterruptEvent 1d8 -NGENProcess 188 -Pipe 154 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 234 -NGENProcess 214 -Pipe 230 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 238 -NGENProcess 224 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 23c -NGENProcess 188 -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 240 -NGENProcess 214 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 188 -NGENProcess 214 -Pipe 234 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 188 -InterruptEvent 24c -NGENProcess 244 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 244 -NGENProcess 240 -Pipe 160 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 228 -NGENProcess 214 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 214 -NGENProcess 24c -Pipe a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 254 -NGENProcess 240 -Pipe 188 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 240 -NGENProcess 228 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 25c -NGENProcess 24c -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 264 -NGENProcess 228 -Pipe 214 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 228 -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 26c -NGENProcess 254 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 254 -NGENProcess 264 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 274 -NGENProcess 25c -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 25c -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 27c -NGENProcess 264 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 264 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 284 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 26c -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 28c -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 27c -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2248
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c0 -NGENProcess 2b8 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2c8 -NGENProcess 2a4 -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2cc -NGENProcess 2b8 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b8 -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2c4 -NGENProcess 29c -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2d8 -NGENProcess 2d0 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2e0 -NGENProcess 29c -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2e4 -NGENProcess 2dc -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 2b8 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 29c -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2dc -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2b8 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 29c -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2dc -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2b8 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 29c -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2dc -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:1580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2b8 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:1952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 29c -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2dc -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2b8 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 29c -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2dc -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:1520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2b8 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:2012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 29c -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:2348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2dc -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2b8 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 29c -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:3000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2dc -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 2dc -NGENProcess 330 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:1488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 340 -NGENProcess 29c -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 33c -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 330 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:2136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 29c -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 33c -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:2776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 330 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 29c -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:3004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 33c -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:1448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 330 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 29c -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:1136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 33c -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:2960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 330 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:1772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 29c -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:1824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 33c -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 330 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:1072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 29c -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 33c -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 330 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:1176
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 29c -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 33c -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 330 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 29c -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 33c -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 330 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 29c -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 33c -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 330 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 29c -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 33c -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 330 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3ac -NGENProcess 3b8 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3a4 -NGENProcess 330 -Pipe a8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 330 -NGENProcess 3a0 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 3c0 -NGENProcess 3b8 -Pipe 138 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3b8 -NGENProcess 3a4 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3c8 -NGENProcess 3a0 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3c4 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3c4 -NGENProcess 3b8 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3d4 -NGENProcess 3a0 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3d0 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3b8 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2196

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

Filesize
648KB

MD5
878073992b54e1e1a76bdde8ebb9eee9

SHA1
303f715b5441f6eb9d9c9a005fe39ddcfbd905da

SHA256
b983730ee5a613d02b866af14283c56d89712dd8a91a96cc6a5d7fe8c1d3c6a7

SHA512
3325f96fdc2f7ec747503420c211c1502cf941398f54dcef7cf7af0cec3fe36329f8ef82440ccbf9614dd4896bc6018315f44e6e4dcd28d3156cd29d958b2102

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.5MB

MD5
c67bf438bf81621fad809d4811968e3d

SHA1
aec1834cbc9d8abce94554da6d1daff06089f672

SHA256
5a64b9ce952d8f6af399ceae66278ea613f7728fbd0e20ee2db2770caf3d5ca6

SHA512
5a3383e0814aba24fbd9f54d94c01836367532c35f445fba3a06f99234a5efc105ad6dc04e44fd075127aa5121e0b769ec073d2dbd85aff56e506e9762336e39

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
5a3aa503c262a32e7c58dfb038f91394

SHA1
0e77c004999ea51f01618caf0a6a43c9501dfe85

SHA256
b9497172a8d026fb8d3799cd967660e444f4279003be1a424626a53085a2c15f

SHA512
fbead210b2cc81adf869b93c666c2700635c0168a584e3aca8c5528b63b5bd6f724ad3e61622ef1a9c5920bf4f5ff743c172b4268ae5cb9aa6c17574fba3369b

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.2MB

MD5
9e678b97fb6e416b99f1c4f7402e00fd

SHA1
27e20a9c670313896ae86b7305470158ad2e9761

SHA256
820c993f0b48ad633ab3d319fb566599443aabd040d0bed1e0b814f9af2763a6

SHA512
7dc7172b71fe55245550ba4ce8382df0b6e36b8656d1fdc511d869b1c5ace1d00ef88a135c94ebdea94332681272403665d59b6fd46f1ca0ab78d6736b86876b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
6438b12cc81a239fd0911dc921692f57

SHA1
b1f982bf051b7771961a8528f82df7b556100a9b

SHA256
f82bdb99346699942a6249df6d4a32d3322faff53d37d9b1e26aefbfeef53b33

SHA512
71268bb82b6e44677978811fe598655ddb23f23c74577c12d83c688ec7a5752e218c8fcba855cbcaf0da4bcb50fed3ae2cf6981e859f0ef76c3fdd3562382d50

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
b5cd6fb3fa257daf6da727f42f38db12

SHA1
7799bb01439ed263bc46f624f7dfecb95e655d03

SHA256
765b26252bd91cfe860889eb112fbadb3545512ec952428675950d59c3da0179

SHA512
9214d071ecb8527b482a16c3f0bd15c7fe2226b8d60951079c9d78b1160c3dc3b2bd7667ca8efdb4d37fe10205fb7ff667ef9850f7f23f27079a58f376a9d461

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
5847a3b0871c776cbee0571f10a94bbb

SHA1
e3b71cf33c8c8ba6668eecacf7878f57d7870615

SHA256
96c48bae411a2aa1e4898268ca992c6ba76846376ac7d60ad816df4857a7f746

SHA512
b2482de0d3bc1315e61d77d2b7d5fed428091b9e995ccf299abe14a0c3c15434f644fca1284796cab392586e4ee2006fd5c4fa289e0eedb15bb7fd2dc3422cb5

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
567KB

MD5
b4c8c48b7187b86cbb0a329a65397e22

SHA1
0021bf12afe746278e98dc09f8958435ccabe48d

SHA256
c07ff81e85f192e97d32b5d623b4c473203e9d8c423fd6759c93041c00b8b1fd

SHA512
769e75920daaa4568332c6f733dec4fb006b689e4ec713cc4900fb9cd448a980ee60393aa4f34da7a9213f746d99e657a975907f005843e99647a4d24a31c324

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
e1f9a379f5de654f3437b8cd38c31cbf

SHA1
616cdea4270bf0776dfa3f20999475c84428013d

SHA256
fabdd0cebc7df060dbbed06063d2a0dbae39a24dbfb7fb5575bd9c1b730ce30a

SHA512
f79f78deda7bf3966d03d71d9cc04eb811b61d8639a9ece7740ea102539110cdccbbfb17e21a5fe87a560534c0809ef3a40bb93394c347f5b6ff6580f174b3ae

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
598KB

MD5
f89c2b37cf85e9f8180797b36237436e

SHA1
6eadf948e05eac4eabb5c7c98103706a0fcb7399

SHA256
e4c1fcff9e42abf003b52c12e276a542e9a35f30486310c78efa1342af9e9b78

SHA512
4b2a04e48b7d7d59da76b050a70de412b6edc1c938995d3fe55de9e88a66ad0fb8475d98a1bc0eac5721c26d7d935380155f7331fef1bd0ed4dcd5c626f1e09b

Download Submit
C:\Windows\Temp\CabF9A.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar1180.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\5a2d334ad36b12d6435715759e26389d\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
8e444091b66fe71d6177cc2b2293dc2e

SHA1
c097ff81626d0d2f74247893f19b639dd9297b2a

SHA256
b4e3f8a6e0618d353cff38a14c2b7b561128818fda9aeda60dee3316ea490d70

SHA512
2f32944b5b9d7cd5ce8162af2ee752a087f3d539cd98dd86a358070914fb330ef8391dd522b31c8ec47bedb6f10b9dcb3c16ba2200d6de1a3066f4c13cc5c11d

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a1e33ab6b3467ef3073d9f11744189d6\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
7c6435983d83ddac0b60119ba26ffc49

SHA1
45797c9eb31b1e0d7bc5b859dc6a6214a75811e0

SHA256
9929a1c2486933206943c4302615cadf0db3690336c6cf371d6f54804d9eb8aa

SHA512
08ad325db6fab170a3258aeeb70a92f7b02577fc2e80b58043f8b339d9b4dfa1a0c8c53ef9c8de1e0d164c7ccdaafb66439dd75d092a5cc4662178fd46b01e5f

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ca0d03863f9728740d19d7f1e7207a9f\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
a7c0beb1298738e500e1b8580fdd6f63

SHA1
7a70a87df4938ad3348c0a9ca93ca9d1f6d6a04a

SHA256
78c51318eb9618ecb48b0a4a48eb549f1a0287a84b016be99ba0f5b63d8204d7

SHA512
0e7d31e15f525eea579e36cf3964bf66f10149c4f8e220bc678410aa5e59979b46d7cab02b33dd325f1a1e0d00578b2d6997986f92c0a008a8386337c855c1a4

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ff74abb2c52bf60b18391735b39c7efb\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
5599c75458d1b9be244a032830579e85

SHA1
ae66d38110072a53766432c970dfd7a7abdef7cf

SHA256
02308b40c507222c60fbc329eefd854042991c52dcb0e582bda4b49958dc6534

SHA512
892087cce02f789f5f1ce137cd1fe7f10f52da1455951a8d79206ebbc79ed00ce4186a1bd708771635b2c96e6928fb8fc8cca2752e7a3a0594f3e52dd96f921e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
648KB

MD5
529637ec6f35ee8c99fa1ed0e78038b1

SHA1
744762333d36ad1cd9485b29191361df9176a5ac

SHA256
cb6525b739b8a98771c5bf365cfa93b7d46d96378ef734e31529dce4388863fe

SHA512
ce6a0311523d94866fa5b54feb0baf2c26f26c420118c40d1e37f6681609aa7dea5fd3e037c6b9a3b2bc59a8a185f96591854239b5e4157b5874ab7d9054aef5

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.0MB

MD5
a78ef19d762cbb090178b14bbecc64ad

SHA1
0aa166bb82487a34c9797195ea12ace4f364bc0b

SHA256
4d6a90dc1bfaa1793eab95175a021f049bda49e1ec402f09f59258145c7c9068

SHA512
5fe27912b808ab14892cae9ada5c15f2b4387f04daada857150ba354e246bfbc0a8d814d1f6fb950daf7abcd16a987af88d2dc2158db2f89e6154e930c515ccd

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
723KB

MD5
bffc14ce7849d86f343e52053cf5df87

SHA1
9a3e791fe0eb7b4cd061679d2c7cd341240b577c

SHA256
c695f3eefda9020d5710cc0e3a5bfdb40042c8a5cdb599add21ab736c8dcb708

SHA512
199a37d2bfc1569dd59c9dc5fd3c328ff8d928a72ee67167a863301623cf161d1c5a6df34832bb89a9cac7a47d8ad8b98581b5d12d612798dc955c6d9fa4fbda

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
632KB

MD5
f5b01ded2b7e548c00f372d485a2c29c

SHA1
245dca1b272eede47e935787710ae5e9e3984289

SHA256
81e37ccc2ade83bf15d5854d2c974fc725b2a357bc6b54e71d5d586a22ac9202

SHA512
5655d3f59433601de1416252fbd9ec51ff7691826a0699f30633d21e80365d9aead7af4039d1e4fa2a2e2333d028b7261eced571dd3e73bf21e7afd1b358e003

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
544KB

MD5
ed378ce3a6db92993598c0027823f9dc

SHA1
dc096f203fec9e499ef820a152c2a575b03e542a

SHA256
e4aee1ddf7f7a66a5d747edbbbe5e4b9f6d9c45d58e84d31d18e52b7758951de

SHA512
2916a34b2cabd1e2bf3c74971948aa0e14f0adb3a3a8b9f5f2809dc5504f40ebb39a7cd082b4c3538ffbb9d7885560c55cab61589fffd8f7a0ef9264e5b2e514

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
585KB

MD5
7ec064d9c41675ba29f4c7c948f85899

SHA1
3f762da788042b892e3c4e44ba28808dde3d25dd

SHA256
8911e7d3201196c883de21e76ae8559a14e8029093c226e6d9fb204998e46948

SHA512
da21071611664362773c4b780254367d5ab83ace8190efdf858be5e845a8e4d5a4235ff099707708cc21f35b810cb07e1b6d95acf43399e9b608b34c1585d9ef

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
4b6cb2d474769e965bf8f03e76dba8cd

SHA1
a6cebe8213a14ff6f9503abf66ceb3fc59f3e75f

SHA256
9f7a4f6132de29a45e5bac3ff27154e0f730edcccc1d2edb0e4c2e12ce5c1431

SHA512
e41d7e77431301d2050181f63fd8070f6fe8bbfbd683f3f939721ebc67ceec441649fc66ed364a79b71b26260434af1f7335dd7cb2ad7d6be0164f011a670b23

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
646KB

MD5
14bdb80416981a8470f8bcead552f11f

SHA1
6bfd524e10efba5192cea2bd6ba757703b99b744

SHA256
6f3f986cd14ada193bbf0ef9b23d7e0237b73f423ae3553c060ba618bd970e78

SHA512
7d99aa4516ed8b05dad5bd683c06a7abe0e5c3cbccd2c70042ed24fd64f3425c09a85a91f2fc48d8132dc92d1d47ee7cea55c1a32c299eebf23f777428dc660f

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
633KB

MD5
b4f02c903da1c9e7720a5eb2d08e1877

SHA1
fdd80a6569f84c61f647df45f2116ea6c703930b

SHA256
301c27b4830b3e1bd3cc619b64dbf29b22223dfd9b2bb50d0b21befa3102df14

SHA512
ce87617861a28bf4a2c7c9a7f880938f2c08d49536cf82b93eff52c6741150a3b68ad3bf29befba6346c161342ae2b35255a80d36cd5dec6a7a5697b54fa9d4d

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
522KB

MD5
366ec6382f213b00397e28dcc9cd330f

SHA1
c32d193323c76aab354d9e8e29965936e119270f

SHA256
09075e62c023fde419481b33c4e0dc20a0214073971046fb8291fed47066bd66

SHA512
4492f3cefb840438d0a51b6e7425c6bb8aca5080ce2de74efd448dd1e1ed4447595aa90de8ebf2b574c4b7afbe557dc0393f6aa1f4c604ec19d9002dd4e02f97

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
548KB

MD5
478475fcf21cdc19fdfbabf0cede54c6

SHA1
a5197403998b2f37e9baf29984c98e901ee06b9f

SHA256
fd4640f0b7982341f0e8038ce0ebb6e4f2b1193219d3ee7d931e9261bf5e6718

SHA512
8f005e9bff66258b6ec5dbf7132c668a484b5953fa47a9c53677a42a40ba8998cecd4e0c2bf43e5209ff05f55ed0e28a04e0632067eb5d45e693fb6458a0da2f

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.0MB

MD5
c4ca1c4c52eb8380ecf5db2b4de85b8b

SHA1
dbd4b9e6ba391a0de46089ae4bed3f727503f2e6

SHA256
70001c6f187de4badcb8b9a0fd3aa0dcb527520d93c91a4bc0f3f831331e1a54

SHA512
0885894e1a12c63590fa4c383f703437b2ae9e61bbcda0186df99bcc6a08df4145eba81db1d2a04d46fbd9cbc43174b987051fa4cfdb59f963982a1d34c532cf

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.0MB

MD5
e17f9d0971bfd0b145c4c244cdd78327

SHA1
95b08ee77720a718f972abf8a49ee1c2f1e2ef57

SHA256
2b9243df096b935921e9ced5d868eb9855d73dcae42f03497d22ccaf88e64ead

SHA512
59b254a36263968273ab3fd5ffdb7d1722bff34a322e734d83eac2ff419e6fb79d6533144303844c0887ed8d9948143a86afffc626b81996af62ca66062ab886

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
706KB

MD5
fe6c69572590bc0364c952a728fc394e

SHA1
427a2ae3f2080b37fe3f638af21efb51d815907a

SHA256
28e586ee359df7e92e18f93ea50028b41b5a72392571887e9ace40f8b47aef32

SHA512
f9716c11ef1134fa18991875e3acfb2481b7c174dc151d1a06df1b8046b34130409eeab611efd4bdd3b853ef3f16c6ccd881e2ec0566ec892272e9e663c0cda8

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
1.9MB

MD5
8280785b1dcfd6e4e8d2df8d325b1818

SHA1
4fd9f86a89c5393bbd55fe89e99b650cb70b4ed4

SHA256
ee41a0dbee6c99512f5007fb405748757142a210f32671143e5f406a42d9ece4

SHA512
271dd6c51d91f487a2c1a2c181cf71e0e43aee21b423e1ba4ba9c0c42fb4f6290811853b7f45078d91977628edd5054df832b370f74f66cf27f9296ea11e55de

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
f01bb2ed82084d58cad4911c86735b57

SHA1
5712cf033bc15460dcbe9b8d893dbf75c043deb5

SHA256
045dd1929caaaa799045f9f88eaf80b91662f1d3a667465b6888c53ce3a97061

SHA512
710a12d05a4e293003f74a1dbc39c2f567efe86800694514313c4f1e2975f6e5308489f8c4178c7ae6608d00671fe116c126c3b341aadee257df807801abdd5c

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
590KB

MD5
b9e1a45a7c92e6d5c2745c3b1dc14823

SHA1
b201f144950acdba575f77842f50ab3fb5df48c9

SHA256
dfe741d57f50bc7d6264d6af601e4271e6a4c9b411c62f3a4eceb2a3c6b235ef

SHA512
15ce7a5a45bd2eba61d45a2f855e93eda8ceba32cac0aef3ab4dcbea7be283ad87cad32a11c65e4ad3742b34befcffa77437a04331445639d330fab127222957

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
617KB

MD5
317eb999322bdc49c28e79d3fd37e872

SHA1
fd4cf5a021e9bba37947e034cad12f59843dcc38

SHA256
2407385ab887a6343d3c3f0cbfab7b876dc47a07f042303895b51db4fe6107d7

SHA512
2584597973e3f6b005f414e251a7386ccb433072d100bc029eecbd63bd015847cf85820b52222160b036abdd64bcac7f2ff73dc8b9d3e877b4557edc35ac9954

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8372.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP86AD.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8A84.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8D51.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP906D.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP931B.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
memory/316-435-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/316-433-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/316-431-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/760-82-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/760-154-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/940-173-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/940-171-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1076-453-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1076-451-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1076-452-0x00000000005C0000-0x00000000005D6000-memory.dmp

Filesize
88KB

Download
memory/1136-151-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1136-172-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1380-326-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1380-315-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/1380-311-0x0000000000830000-0x0000000000846000-memory.dmp

Filesize
88KB

Download
memory/1380-310-0x000000001C4B0000-0x000000001C4F8000-memory.dmp

Filesize
288KB

Download
memory/1380-309-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/1380-308-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/1380-316-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/1424-211-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1424-89-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1424-169-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1496-388-0x00000000007B0000-0x00000000007BC000-memory.dmp

Filesize
48KB

Download
memory/1496-391-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1496-389-0x0000000003150000-0x0000000003164000-memory.dmp

Filesize
80KB

Download
memory/1496-386-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1712-364-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1712-362-0x00000000008B0000-0x00000000008C0000-memory.dmp

Filesize
64KB

Download
memory/1712-360-0x00000000006A0000-0x00000000006AC000-memory.dmp

Filesize
48KB

Download
memory/1712-358-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1724-301-0x00000000006B0000-0x00000000006BE000-memory.dmp

Filesize
56KB

Download
memory/1724-306-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1724-302-0x0000000000960000-0x000000000096C000-memory.dmp

Filesize
48KB

Download
memory/1724-303-0x0000000003090000-0x00000000030D8000-memory.dmp

Filesize
288KB

Download
memory/1724-304-0x00000000030E0000-0x00000000030F6000-memory.dmp

Filesize
88KB

Download
memory/2024-441-0x000000001C580000-0x000000001C58E000-memory.dmp

Filesize
56KB

Download
memory/2024-450-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2024-437-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/2196-368-0x0000000000850000-0x000000000085E000-memory.dmp

Filesize
56KB

Download
memory/2196-370-0x0000000000880000-0x00000000008C8000-memory.dmp

Filesize
288KB

Download
memory/2196-372-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2196-366-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2196-376-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/2196-377-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/2196-387-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2196-371-0x00000000008D0000-0x00000000008EA000-memory.dmp

Filesize
104KB

Download
memory/2196-369-0x0000000000860000-0x0000000000876000-memory.dmp

Filesize
88KB

Download
memory/2196-367-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2312-0-0x0000000001000000-0x00000000011EF000-memory.dmp

Filesize
1.9MB

Download
memory/2312-2-0x0000000001000000-0x00000000011EF000-memory.dmp

Filesize
1.9MB

Download
memory/2312-1-0x0000000001034000-0x0000000001035000-memory.dmp

Filesize
4KB

Download
memory/2368-300-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2376-337-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/2376-359-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2376-335-0x00000000006C0000-0x00000000006D8000-memory.dmp

Filesize
96KB

Download
memory/2376-336-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/2376-338-0x0000000000840000-0x0000000000856000-memory.dmp

Filesize
88KB

Download
memory/2376-339-0x00000000008F0000-0x0000000000938000-memory.dmp

Filesize
288KB

Download
memory/2376-340-0x0000000000940000-0x000000000095A000-memory.dmp

Filesize
104KB

Download
memory/2376-341-0x0000000000960000-0x000000000097E000-memory.dmp

Filesize
120KB

Download
memory/2376-348-0x000000001D2C0000-0x000000001D2D8000-memory.dmp

Filesize
96KB

Download
memory/2376-349-0x000000001D2C0000-0x000000001D2D8000-memory.dmp

Filesize
96KB

Download
memory/2384-298-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2384-295-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2392-333-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2392-330-0x000000001C520000-0x000000001C53A000-memory.dmp

Filesize
104KB

Download
memory/2392-329-0x0000000003110000-0x000000000311E000-memory.dmp

Filesize
56KB

Download
memory/2392-327-0x0000000002F30000-0x0000000002F48000-memory.dmp

Filesize
96KB

Download
memory/2392-325-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2392-331-0x000000001C540000-0x000000001C55E000-memory.dmp

Filesize
120KB

Download
memory/2592-417-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/2592-416-0x00000000006A0000-0x00000000006BA000-memory.dmp

Filesize
104KB

Download
memory/2592-421-0x0000000000950000-0x000000000096A000-memory.dmp

Filesize
104KB

Download
memory/2592-432-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2592-422-0x0000000000950000-0x000000000096A000-memory.dmp

Filesize
104KB

Download
memory/2620-150-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2620-58-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download
memory/2620-57-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2660-63-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2660-36-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2660-35-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/2672-395-0x0000000003110000-0x0000000003124000-memory.dmp

Filesize
80KB

Download
memory/2672-400-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2672-399-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2672-410-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2672-394-0x0000000000840000-0x000000000084C000-memory.dmp

Filesize
48KB

Download
memory/2672-393-0x00000000007C0000-0x00000000007CC000-memory.dmp

Filesize
48KB

Download
memory/2804-54-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/2804-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2804-21-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/2824-414-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2824-412-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/2824-411-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/2824-409-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2848-46-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2964-296-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download