expiro | f5377f544d5c05daff97e1dc9614700a6bc32c080c00e173b402fec9a3aad1b2

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
Size

611KB
MD5

7af9483222993994df1885ebe57c8740
SHA1

674ae56f9fee9c01b983b78d473aa1e2c4a4bbc4
SHA256

f5377f544d5c05daff97e1dc9614700a6bc32c080c00e173b402fec9a3aad1b2
SHA512

c697ad687463904b5cffc12e6ae94a16c7028bc473797335a6390389b73a6504015a1a93bba38a90fb1b1e0fc2fda22d6d3ef54700054844a0a028917584f04e
SSDEEP

12288:KLh0jD9bLcbwrrAQ722Jyxb1aMs9zcuWvcwCvdFIqsYk3nVdW:T9sbwr0QycQqfwUjPvk3V

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2244-2-0x0000000000400000-0x000000000065A000-memory.dmp	family_expiro1
behavioral1/memory/2528-54-0x0000000010000000-0x0000000010258000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 64 IoCs

pid	Process
2528	mscorsvw.exe
476	Process not Found
2744	mscorsvw.exe
1296	mscorsvw.exe
1748	mscorsvw.exe
1228	elevation_service.exe
568	IEEtwCollector.exe
1144	mscorsvw.exe
1616	mscorsvw.exe
2220	mscorsvw.exe
1456	mscorsvw.exe
2356	mscorsvw.exe
1404	mscorsvw.exe
1060	mscorsvw.exe
2360	mscorsvw.exe
1808	mscorsvw.exe
1628	mscorsvw.exe
2788	mscorsvw.exe
2584	mscorsvw.exe
2684	mscorsvw.exe
1764	mscorsvw.exe
924	mscorsvw.exe
1496	mscorsvw.exe
1612	mscorsvw.exe
320	mscorsvw.exe
1784	mscorsvw.exe
2248	mscorsvw.exe
2608	mscorsvw.exe
2116	mscorsvw.exe
700	mscorsvw.exe
1744	mscorsvw.exe
1572	mscorsvw.exe
1588	mscorsvw.exe
1956	mscorsvw.exe
3044	mscorsvw.exe
1724	mscorsvw.exe
1380	mscorsvw.exe
2568	mscorsvw.exe
2828	mscorsvw.exe
2824	mscorsvw.exe
584	mscorsvw.exe
2940	mscorsvw.exe
2836	mscorsvw.exe
844	mscorsvw.exe
1656	mscorsvw.exe
1692	mscorsvw.exe
2316	mscorsvw.exe
2676	mscorsvw.exe
2748	mscorsvw.exe
3044	mscorsvw.exe
2640	mscorsvw.exe
2052	mscorsvw.exe
2144	mscorsvw.exe
2860	mscorsvw.exe
2568	mscorsvw.exe
636	mscorsvw.exe
1672	mscorsvw.exe
2344	mscorsvw.exe
2452	mscorsvw.exe
2808	mscorsvw.exe
1860	mscorsvw.exe
2940	mscorsvw.exe
1872	mscorsvw.exe
2480	mscorsvw.exe

Loads dropped DLL 64 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
1060	mscorsvw.exe
1060	mscorsvw.exe
1808	mscorsvw.exe
1808	mscorsvw.exe
2788	mscorsvw.exe
2788	mscorsvw.exe
2684	mscorsvw.exe
2684	mscorsvw.exe
924	mscorsvw.exe
924	mscorsvw.exe
1612	mscorsvw.exe
1612	mscorsvw.exe
1784	mscorsvw.exe
1784	mscorsvw.exe
2608	mscorsvw.exe
2608	mscorsvw.exe
700	mscorsvw.exe
700	mscorsvw.exe
1572	mscorsvw.exe
1572	mscorsvw.exe
1956	mscorsvw.exe
1956	mscorsvw.exe
1724	mscorsvw.exe
1724	mscorsvw.exe
2568	mscorsvw.exe
2568	mscorsvw.exe
2824	mscorsvw.exe
2824	mscorsvw.exe
2940	mscorsvw.exe
2940	mscorsvw.exe
844	mscorsvw.exe
844	mscorsvw.exe
3044	mscorsvw.exe
3044	mscorsvw.exe
2640	mscorsvw.exe
2640	mscorsvw.exe
2144	mscorsvw.exe
2144	mscorsvw.exe
2880	mscorsvw.exe
2880	mscorsvw.exe
1712	mscorsvw.exe
1712	mscorsvw.exe
2284	mscorsvw.exe
2284	mscorsvw.exe
2156	mscorsvw.exe
2156	mscorsvw.exe
1012	mscorsvw.exe
1012	mscorsvw.exe
2372	mscorsvw.exe
2372	mscorsvw.exe
2412	mscorsvw.exe
2412	mscorsvw.exe
1860	mscorsvw.exe
1860	mscorsvw.exe
2972	mscorsvw.exe
2972	mscorsvw.exe
1596	mscorsvw.exe
1596	mscorsvw.exe
1692	mscorsvw.exe
1692	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4177215427-74451935-3209572229-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4177215427-74451935-3209572229-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\G:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\Q:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\S:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\P:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\Z:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\I:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\M:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\T:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\V:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\E:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\J:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\O:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\W:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\H:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\K:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\N:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\L:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\R:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\U:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\Y:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\X:	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File created	\??\c:\windows\system32\ipnbhenp.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\qcijdbgp.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\eiacckmo.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\wbem\magbjdbg.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File created	\??\c:\windows\system32\cdphggjn.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File created	\??\c:\windows\system32\lgkhaceq.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\pfpjdkae.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\knmjcebf.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\jdmgpofe.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\SysWOW64\kjnjneco.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\beglobaa.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\SysWOW64\ghdfbeho.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\okgengme.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\qkjqpjbj.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\SysWOW64\nokpaaji.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\windows\system32\mginaqjb.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\microsoft office\office14\ccqglhfo.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ighnagcm.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\7-Zip\nklemblo.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\hfdcheod.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\njakmajo.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dgilkpmn.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Internet Explorer\onnmbqjl.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	\??\c:\program files\windows media player\jeqinmkn.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Internet Explorer\afgglblk.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\klonohhl.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\onakajab.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\gakpqfhp.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File created	C:\Program Files\7-Zip\nnknaeep.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\gdaoemja.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\cpkcoelj.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\idddgalc.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\akaajeom.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kefbfhkg.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\nlfifejp.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Internet Explorer\aglddoil.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\7-Zip\dklkkafp.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\eqiodbdg.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kfefgkli.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ckillgah.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index162.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15f.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP933B.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPED1D.tmp\Microsoft.Office.Tools.Common.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9859.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index160.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index165.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP23C6.tmp\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index163.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP99DF.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP2990.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	\??\c:\windows\ehome\ofhjcgpm.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP33BD.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\aodcnmib.tmp	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15e.dat	mscorsvw.exe
File created	\??\c:\windows\servicing\iehkghpn.tmp	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15c.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15c.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2244	JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe
Token: SeShutdownPrivilege	1748	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1144	1748	mscorsvw.exe	36
PID 1748 wrote to memory of 1144	1748	mscorsvw.exe	36
PID 1748 wrote to memory of 1144	1748	mscorsvw.exe	36
PID 1748 wrote to memory of 1616	1748	mscorsvw.exe	38
PID 1748 wrote to memory of 1616	1748	mscorsvw.exe	38
PID 1748 wrote to memory of 1616	1748	mscorsvw.exe	38
PID 1748 wrote to memory of 2220	1748	mscorsvw.exe	40
PID 1748 wrote to memory of 2220	1748	mscorsvw.exe	40
PID 1748 wrote to memory of 2220	1748	mscorsvw.exe	40
PID 1748 wrote to memory of 1456	1748	mscorsvw.exe	41
PID 1748 wrote to memory of 1456	1748	mscorsvw.exe	41
PID 1748 wrote to memory of 1456	1748	mscorsvw.exe	41
PID 1748 wrote to memory of 2356	1748	mscorsvw.exe	42
PID 1748 wrote to memory of 2356	1748	mscorsvw.exe	42
PID 1748 wrote to memory of 2356	1748	mscorsvw.exe	42
PID 1748 wrote to memory of 1404	1748	mscorsvw.exe	43
PID 1748 wrote to memory of 1404	1748	mscorsvw.exe	43
PID 1748 wrote to memory of 1404	1748	mscorsvw.exe	43
PID 1748 wrote to memory of 1060	1748	mscorsvw.exe	44
PID 1748 wrote to memory of 1060	1748	mscorsvw.exe	44
PID 1748 wrote to memory of 1060	1748	mscorsvw.exe	44
PID 1748 wrote to memory of 2360	1748	mscorsvw.exe	45
PID 1748 wrote to memory of 2360	1748	mscorsvw.exe	45
PID 1748 wrote to memory of 2360	1748	mscorsvw.exe	45
PID 1748 wrote to memory of 1808	1748	mscorsvw.exe	46
PID 1748 wrote to memory of 1808	1748	mscorsvw.exe	46
PID 1748 wrote to memory of 1808	1748	mscorsvw.exe	46
PID 1748 wrote to memory of 1628	1748	mscorsvw.exe	47
PID 1748 wrote to memory of 1628	1748	mscorsvw.exe	47
PID 1748 wrote to memory of 1628	1748	mscorsvw.exe	47
PID 1748 wrote to memory of 2788	1748	mscorsvw.exe	48
PID 1748 wrote to memory of 2788	1748	mscorsvw.exe	48
PID 1748 wrote to memory of 2788	1748	mscorsvw.exe	48
PID 1748 wrote to memory of 2584	1748	mscorsvw.exe	49
PID 1748 wrote to memory of 2584	1748	mscorsvw.exe	49
PID 1748 wrote to memory of 2584	1748	mscorsvw.exe	49
PID 1748 wrote to memory of 2684	1748	mscorsvw.exe	50
PID 1748 wrote to memory of 2684	1748	mscorsvw.exe	50
PID 1748 wrote to memory of 2684	1748	mscorsvw.exe	50
PID 1748 wrote to memory of 1764	1748	mscorsvw.exe	51
PID 1748 wrote to memory of 1764	1748	mscorsvw.exe	51
PID 1748 wrote to memory of 1764	1748	mscorsvw.exe	51
PID 1748 wrote to memory of 924	1748	mscorsvw.exe	52
PID 1748 wrote to memory of 924	1748	mscorsvw.exe	52
PID 1748 wrote to memory of 924	1748	mscorsvw.exe	52
PID 1748 wrote to memory of 1496	1748	mscorsvw.exe	53
PID 1748 wrote to memory of 1496	1748	mscorsvw.exe	53
PID 1748 wrote to memory of 1496	1748	mscorsvw.exe	53
PID 1748 wrote to memory of 1612	1748	mscorsvw.exe	54
PID 1748 wrote to memory of 1612	1748	mscorsvw.exe	54
PID 1748 wrote to memory of 1612	1748	mscorsvw.exe	54
PID 1748 wrote to memory of 320	1748	mscorsvw.exe	55
PID 1748 wrote to memory of 320	1748	mscorsvw.exe	55
PID 1748 wrote to memory of 320	1748	mscorsvw.exe	55
PID 1748 wrote to memory of 1784	1748	mscorsvw.exe	56
PID 1748 wrote to memory of 1784	1748	mscorsvw.exe	56
PID 1748 wrote to memory of 1784	1748	mscorsvw.exe	56
PID 1748 wrote to memory of 2248	1748	mscorsvw.exe	57
PID 1748 wrote to memory of 2248	1748	mscorsvw.exe	57
PID 1748 wrote to memory of 2248	1748	mscorsvw.exe	57
PID 1748 wrote to memory of 2608	1748	mscorsvw.exe	58
PID 1748 wrote to memory of 2608	1748	mscorsvw.exe	58
PID 1748 wrote to memory of 2608	1748	mscorsvw.exe	58
PID 1748 wrote to memory of 2116	1748	mscorsvw.exe	59

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	mscorsvw.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7af9483222993994df1885ebe57c8740.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7af9483222993994df1885ebe57c8740.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:1296

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 164 -NGENProcess 168 -Pipe 174 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 164 -NGENProcess 168 -Pipe 178 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 154 -InterruptEvent 220 -NGENProcess 200 -Pipe 204 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 25c -NGENProcess 164 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 230 -Pipe 234 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 220 -NGENProcess 264 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 178 -NGENProcess 230 -Pipe 180 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 154 -NGENProcess 230 -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 154 -InterruptEvent 274 -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 278 -NGENProcess 178 -Pipe 154 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 26c -Pipe 164 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 26c -NGENProcess 168 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 284 -NGENProcess 27c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1c0 -NGENProcess 230 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 168 -NGENProcess 280 -Pipe 1c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 280 -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 294 -NGENProcess 284 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 284 -NGENProcess 168 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 29c -NGENProcess 27c -Pipe 1f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 27c -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2a4 -NGENProcess 168 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 168 -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 284 -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 294 -NGENProcess 2a4 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 29c -NGENProcess 284 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 268 -Pipe 168 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2bc -NGENProcess 2ac -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2ac -NGENProcess 29c -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2c4 -NGENProcess 268 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 268 -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 2cc -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 29c -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2bc -NGENProcess 2cc -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2e4 -NGENProcess 2bc -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2f4 -NGENProcess 2b0 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 29c -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 300 -NGENProcess 2bc -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2f4 -NGENProcess 2bc -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2bc -NGENProcess 308 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2e4 -NGENProcess 2c4 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2c4 -NGENProcess 2f4 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 320 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 314 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2f4 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 320 -NGENProcess 330 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 30c -NGENProcess 2f4 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 334 -NGENProcess 328 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 330 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2f4 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 334 -NGENProcess 340 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 344 -NGENProcess 2f4 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:1004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 350 -NGENProcess 340 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 344 -NGENProcess 330 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:1280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 358 -NGENProcess 30c -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:2888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 340 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:3064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 344 -NGENProcess 360 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 330 -NGENProcess 348 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 30c -NGENProcess 360 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:1680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 328 -NGENProcess 35c -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 36c -NGENProcess 340 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 348 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 35c -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 340 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 370 -NGENProcess 380 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 364 -NGENProcess 340 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:2600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 364 -NGENProcess 370 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:2656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 36c -NGENProcess 340 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 37c -NGENProcess 364 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 390 -NGENProcess 330 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 370 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 364 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 330 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 370 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 364 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:1496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 330 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 394 -NGENProcess 370 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:2092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 370 -NGENProcess 32c -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:2148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 39c -NGENProcess 398 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:1108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 394 -NGENProcess 330 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:1876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b8 -NGENProcess 364 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:2464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 32c -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 330 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:1760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 364 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:1200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 32c -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 330 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3c4 -NGENProcess 3d0 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3bc -NGENProcess 330 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3d8 -NGENProcess 3cc -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3c0 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 330 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 3cc -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3c0 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 330 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3ec -NGENProcess 3e8 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e4 -NGENProcess 3e8 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3f8 -NGENProcess 3f0 -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3f0 -NGENProcess 3dc -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 3e0 -NGENProcess 404 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 404 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:2208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 40c -NGENProcess 3d8 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 3d8 -NGENProcess 3ec -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 414 -NGENProcess 404 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 404 -NGENProcess 40c -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:2436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 3e4 -NGENProcess 3ec -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:1288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 330 -NGENProcess 404 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:1780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 41c -NGENProcess 3e0 -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  PID:1656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 3f0 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:1584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 404 -Pipe 178 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 3e0 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:1628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 3f0 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 430 -NGENProcess 404 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:2664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 41c -NGENProcess 3e0 -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 434 -NGENProcess 424 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:1688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 43c -NGENProcess 404 -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:2704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 3f0 -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:2712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 424 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:1664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 404 -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:1440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 3f0 -Pipe 41c -Comment "NGen Worker Process"
  2⤵
  PID:2144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 450 -NGENProcess 424 -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:2960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 454 -NGENProcess 404 -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  PID:2772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 458 -NGENProcess 3f0 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 444 -NGENProcess 424 -Pipe 448 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  PID:2412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 3f0 -NGENProcess 424 -Pipe 428 -Comment "NGen Worker Process"
  2⤵
  PID:2808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 464 -NGENProcess 450 -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 450 -NGENProcess 45c -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 46c -NGENProcess 424 -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:2032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 464 -Pipe 444 -Comment "NGen Worker Process"
  2⤵
  PID:2352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 474 -NGENProcess 45c -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:3032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 474 -NGENProcess 470 -Pipe 424 -Comment "NGen Worker Process"
  2⤵
  PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 42c -NGENProcess 45c -Pipe 464 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  PID:2972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 470 -NGENProcess 45c -Pipe 468 -Comment "NGen Worker Process"
  2⤵
  PID:2440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 480 -NGENProcess 458 -Pipe 47c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 458 -NGENProcess 478 -Pipe 450 -Comment "NGen Worker Process"
  2⤵
  PID:2348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 488 -NGENProcess 45c -Pipe 46c -Comment "NGen Worker Process"
  2⤵
  PID:272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 48c -NGENProcess 484 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:2752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 490 -NGENProcess 478 -Pipe 470 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 478 -NGENProcess 488 -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  PID:1376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 480 -NGENProcess 484 -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  PID:856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 484 -NGENProcess 490 -Pipe 48c -Comment "NGen Worker Process"
  2⤵
  PID:2600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 4a8 -NGENProcess 488 -Pipe 4a4 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  PID:2988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 488 -NGENProcess 480 -Pipe 474 -Comment "NGen Worker Process"
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 4b0 -NGENProcess 490 -Pipe 134 -Comment "NGen Worker Process"
  2⤵
  PID:400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 490 -NGENProcess 4a8 -Pipe 4ac -Comment "NGen Worker Process"
  2⤵
  PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4a8 -NGENProcess 490 -Pipe 4b8 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  PID:2088
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 208 -NGENProcess 490 -Pipe 4a0 -Comment "NGen Worker Process"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 488 -NGENProcess 4bc -Pipe 49c -Comment "NGen Worker Process"
  2⤵
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 4c0 -NGENProcess 4a8 -Pipe 484 -Comment "NGen Worker Process"
  2⤵
  PID:696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4c8 -NGENProcess 490 -Pipe 4c4 -Comment "NGen Worker Process"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 490 -NGENProcess 488 -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 4d0 -NGENProcess 4a8 -Pipe 4b4 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4a8 -NGENProcess 4c8 -Pipe 4cc -Comment "NGen Worker Process"
  2⤵
  PID:2972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4d8 -NGENProcess 488 -Pipe 4c0 -Comment "NGen Worker Process"
  2⤵
  PID:876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 4d4 -NGENProcess 4dc -Pipe 4b0 -Comment "NGen Worker Process"
  2⤵
  PID:712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4e0 -NGENProcess 4c8 -Pipe 490 -Comment "NGen Worker Process"
  2⤵
  PID:1596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4e4 -NGENProcess 488 -Pipe 208 -Comment "NGen Worker Process"
  2⤵
  PID:2184

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ncjookla.tmp

Filesize
694KB

MD5
70a994cf08e8712ecfcd2f892037be1e

SHA1
67be802888526149d81a7f84851b046ecbd4a0eb

SHA256
ad021a1ae76e405d5573c3cef5c022f3450108887f0b4567dbac7770025756fd

SHA512
1072f5784abcab8cf2169b51ee1100770c9c0665847b60126a719f53be336dad47a15b3ce359e4922cfdd3f685907f4eb03fb6407920e199ba40f8a0c64238d4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.6MB

MD5
eaf6a5bc289d35ee6d64d89ee69d238e

SHA1
74d6f97616b13c2990b793f28eb3331439df8175

SHA256
4810237901b281d422b6c79cdcdf873045e4e2546c5ab3394531a96ce1f59cd7

SHA512
a0fd338d6be2a46c3d3d8c85cf05430b0d74b0e1672058c9d811a6c5301fa1bdb72aeb838381de0688582b03c070a7638d25ddd5286f1d8a1cb8cd6c288d8355

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\odadaonc.tmp

Filesize
4.8MB

MD5
151110c695881c4f1097c77977b1b091

SHA1
146e130d3292c9240255a4e53546156133121d6f

SHA256
36cae64421ecae4aae9bd0ffa134e918c1bdf9e9bb3ca69c6fa490d42978cb5f

SHA512
130c8a845cb2f561230a78aeb6a1271ab4cd26764989922f3710da8c6f31d3bd522afa50708e8c15cc6aa564f5093750fb351b875eeba0eb0075dd8d670d5014

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
ccfdefca2b2b3ed777d57fd6b68c0f38

SHA1
09b580d3402f7b8bb9c8b3fc6c83b86c8111140f

SHA256
6a46b04418a428b590bee96ddc3ba1f48dfbf1c25166f2325d4eb4ee61596bd2

SHA512
b2c72950766997c6fbe22e6d04dc2b3bab040d4fb3f136baa2044f0d4854805b028fcbcf4ca389bc6e3bdc1533c28a09eca212d7f7ee19222743b7520def8095

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
29c4cff5018fa22c710bf546ef4256bb

SHA1
ddeaabb85c1de15ba88da86d1b98899d81c54121

SHA256
283cc4be59f8ca4ab0f513455fa058c991c9134e8611bcbffe1402e477c8b028

SHA512
cdf42ddab576de64354d48d2713fe217a2e6167d7969fe85149e2e1a7dbeb3b45797a9a738fa69c2f78b178186ea0a2d8d6968310d58369af79a81509e7e5900

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
640KB

MD5
be8eed4a7c737a8eece90124bdb59e06

SHA1
0a0ca9903cd32b78ce999b5ef02810d8a1d28b74

SHA256
21db968f2d7838626357ae69922dc74299f71bfab5dacf8f4d2edd4596139a6d

SHA512
4596f9a33a777bbe561b6021eae45cd21a1bde1fb99f71ec528ae888051b0b76f8b5161e0f7793137800130fddb69dda505ad523347ef055dffacc8c2469e918

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
3c3d407413f360c2b49b0177619e76ee

SHA1
13819c4beb5c0efa7d7e078ede6f9edf794ff182

SHA256
904145e3d8c4bd581ceb11650248ddad6a6a2a6622da73afd328354a96b3b894

SHA512
6314f74d6749836b74992df32b75c60acb006225b5bbb7cb8fb5c5fb86dc72155f6bce050e7d115c9a6d50e0ca56c86d2b7d09cae47d5bb34b7240228fcc0bd6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
7bd5deded165fb542419dc2ff7f6b6ef

SHA1
b1afe9d117cc605c7b5d2bb26c51338781a75bde

SHA256
47e632f86100458961be14b0347bd907aa6436fe9401afa5033268d1d02e32eb

SHA512
619186a68d3aa5d5520a32f662584f86d39a31a42f1887361a860ceb6ef43b73b71feb2b81f48e063bf8581ff7efc93fdad17b515b70e904dfd16d075126598c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
4KB

MD5
8ae876d70f307d5a458ad72acd6d6725

SHA1
83acc5b1e9c7955ff8234c2ad9c40f20f87fb5f3

SHA256
751cd8cc1672c8b6a94b3063385abee35ee613338e61e49d54b71d8d5596e9e0

SHA512
b6993b117e562d083f2c10ef4b342ff3139998cb39b7eb2bee9d085c06492a32e90ccb508fcd96ea4dd0350071b981e7cbac3558eabfe9b1fdec09d8c7b1d44c

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
613KB

MD5
61c982cab81f38e50e172dc54ec4e1ee

SHA1
cbf55ff490de7be217fa2a5256d26361b4928e76

SHA256
fd2120a24699e5adb9f812894e709f58be4212b452680e39e343387349fdff5f

SHA512
a5346d41d04e442f86da8b582dd801f3f45bd77dafb86ae11b376f6ff1ece4e6530c08353dcb9f3285edcc928c781b2bb96d367423f2ce21330d9cbfee7f4500

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
b55fab4321bbb64edab1ab0f5000a948

SHA1
40955ccd07db050b4cb4f58b7ee9ad194bacf764

SHA256
75ee102aa6db0c066040550fb2484dc35b295fa875abb03796c67e049cd39d6c

SHA512
9624359cd7af81690c7e5bac5da1a7b879a2189158a5c23b6953d6aca516c9d8899b4996fd0f9d0a2b7e156c0812813c0984e0bbeb93a96c00cc6bc33e26089a

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
644KB

MD5
36cc66df5c73bbc91ea8e2951317b4ac

SHA1
4158e6bf88647f3da1f186d9b71bfe2d85212e88

SHA256
aedd58dfaffa46caff89c5fc2f2faa8e04991c85eb84c8fb9a6186b6704cd5bd

SHA512
51b6684c60a7fa44c3b4f6098bdce14cab04685fb003d6649bf743af6703258605bf7899bf02c4f37f29f19782e62f713915bfa2fcaa49c91fc1ff767aab3454

Download Submit
C:\Windows\Temp\CabEC52.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarED5D.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\19c2b79f666960d7a242a04c5d76f114\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll

Filesize
227KB

MD5
4ec89a4e8fe1b5b9916ace8dbabc0418

SHA1
dafec0baada7f2fa425978a5816fe852053fb1fc

SHA256
6c4f0f9775fbaf81122cba659cdd5449974810c772d51e152fc20016211988e0

SHA512
648704c9808193a045035858b68f7e98981da8c1c98f07e04afacb1b181beeb0bf7df9f42a563636093aff05f01f0c7faacdde0561e9e8776e914611f9f43b34

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\36c5a9d83dfb1b6b1c0202fb505c9daf\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll

Filesize
221KB

MD5
78c5a493778f578ef5517fe161162819

SHA1
faf377bdc739623fb5f111d51af97e8c78f11525

SHA256
aa332098d4073a4c4a654d16ec5fd0b6e2b1f284890057e164204d756095dd93

SHA512
6a905ef75d2eb909cd30c3916110f6b41a849ff4ed9f4c19e4d5f85ccf05d9b9dd009b351003386778801909d2628ce4c6cd9b1a54e3a0cd1ab9c5496f35cf50

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Filesize
91KB

MD5
adc5887e89bc56694a193d92898d3518

SHA1
267f14c45a86d50ad627c6cb00626049e9c1ee20

SHA256
edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b

SHA512
bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Filesize
1.8MB

MD5
04a6857c04546270358d14398fde209e

SHA1
596a3e11ac6c303c679edfd6c30aa71e8eaf8a23

SHA256
8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285

SHA512
4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\5bd6a44ddd52b91213db68ba1bf5fa8a\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
cfc7df34ecb48af77adfc265c83a6f64

SHA1
43e1fe892b4b7f4bb9a58c87de90c368a0474609

SHA256
ef56b5bf24177653402bf6db8705a257300081db08dc68b3a530d54fb8f1c463

SHA512
c24f875f02a364dd264cc6164d926ab64a56c5cb7085c3ef495e93360e04c588d49d5a8ec3299e37a05338e2273f6d4eae4012bb1e19110430b049bdf7a6a4b2

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Filesize
381KB

MD5
0811b25e0449e04f782127bc6f8ac5e3

SHA1
dc1766e20ee338b12fa80e3ce0052ef97ddf9e20

SHA256
20d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c

SHA512
a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\74054b5793bfb8c8c0753b4d4aead8e3\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll

Filesize
947KB

MD5
b1aa17d171be82960213057ca35815a9

SHA1
6c68a8a2c524ddbe04395dfa613378bb311aa314

SHA256
c632156c276f9189d0f53addcc1043006d86188e3b74d9c4042ab2110b6cfd4e

SHA512
6f042aec9c74da86d15322d4300d93e4a9e69ad3555b302d42d7629dfa060209898b4569a380e9da1a785ddb53a6e0cc0f7543606f17ee467277990971c2fc1a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\82a580d06e16500cf907c8adf0d5d124\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
1bfb1aaace325ab88dc6b1d59a2bb497

SHA1
f43d977a84ade419e4284e6bc588be5ff62cc3ce

SHA256
38363bde0a49b40692abac5298bad9a46e78a6c25970545cf3828f99b9bc334f

SHA512
878a5e59b5586f7b93ffffb0b1e70777f633e4800853a092c91995f5e5351f8c79cc4f8a7549a6c12b8effc68c8315138f8991af7bf43d771ea1ff030b81e813

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a3cd261a6f4304f956947022269ac7ff\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
a70159c89c691333a6b3223770a85e4a

SHA1
64af89ed98f2673420017927500bf82febdf2861

SHA256
ade0e5f6dbbc8d9563d371f59adbb7fb8298fcd6879e98b5fc41d967ae254fd0

SHA512
52d663200c63023b566cf05ce5fb29f1120c975bcc75b704b647403b1e17c7d5c14e80d18cb01cbc7fdee9c0acc7b15d6f4d06ec8ad166e68bde5c6be7685581

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a3d3ce82f6feb464aef859d623d1a439\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
e7d716b20a3f937d03d4e2a80f985bcd

SHA1
eaa67bf18aaef629229039386963a1fc810109c8

SHA256
d2614f4278e0148e767b31fa5d9722a2962b7dcf125772dfe0ea85eaf063cb37

SHA512
b39154e3ac9760f1db5e308c0583b5b3d77c6234ff8d0ffdacb83a1ada986e0d481e89dc5d385acde39e9712d32cc964542e5576919eef592c1604b3a79d779d

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Filesize
483KB

MD5
aae5a97685a809d0a0f661f9319f8a12

SHA1
b5fdd4ec4cc057fccc868de4f4910be89e23e48a

SHA256
c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233

SHA512
d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ad7d01564f0056d2476f6ae5d257356b\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll

Filesize
436KB

MD5
748bed51a810c033b91c660b5776ab95

SHA1
ec2616fb01949fb9fe4b0eea707f7095b69aa9e4

SHA256
45ee38adadeb1586532e8dd4baba14740ccb0801c2e21318c35268543e0ddef7

SHA512
dc0cce4c633b8e43d8f6d565fcfc73d79bfea375a79ae5057af6d3cc1b62f929e34c95bcfe2f7d378ec7f421fafdd9ab73cff454df0934e2d2f45a52580e9df0

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\daa561280ac1119d9c2694442212aaea\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll

Filesize
487KB

MD5
aefa28d036740086ae52d157f245200a

SHA1
d502f55fa76c3cdb69c8ab97321cd9b9a4b68e55

SHA256
75127c1e3a30e544413d7eb24fd726bacf8c3a3951ddba1fc990ad00a7f1cc49

SHA512
3943c099644525fc2b3a50f843cc1612a003d4f92a9187b2fcecaaf90b33071bced0db4608a91bb59c6bf5d1f6f4eb158881bf78cced0597b7bc3045d9b66ee3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
694KB

MD5
00dbd62f3be544124b032d442f9598a2

SHA1
ddebee579b12ac774a2756ca8bfc712de59621cd

SHA256
dd4f977e253c5042a2730130b5de39e2d58b5f1d609c3bc06f2a70d4fa68e27e

SHA512
df17ed31dc15991377289db542b7970e0464decda9edebca7aa411f3622a65aa51774a260ac1042ba20733d44bef6f5dcbb83581430f22018d2342bccea148f8

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
d991687550fa990b37aab38a566bd217

SHA1
df31306dccd800cc6690c0ce92ff1a338428a847

SHA256
620f17f1b440a62742de600dd84e0c6d3dc265f3b823fef7037cfb1847113f68

SHA512
b54e8acd6e034c8080c58fb307db9a5f1175f8db78b7d219e1be39f5d85652b016a02a6b76dda82c565626aa5f92465baa11b009598968b72c2086e67adfde65

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
773KB

MD5
06b3aafb737d9ebb7154de1c96f7c6dc

SHA1
3d898e61eaa73a230223c08774e5a2d16d8a72cd

SHA256
01aa13687f102ad2ff8832c6f5de083e2dd26b98000abe9c2ff76a7bfae22028

SHA512
89dbaf2895a12d25f4cf9053cc2ad31d68cd13f43f7c394ac530a0ae0eb55af8efbbe032a3497fd1da490f81c671e05562b24cedf5fb6200c0fd08dfd0b7cca1

Download Submit
\??\c:\program files\windows media player\wmpnetwk.exe

Filesize
2.0MB

MD5
07c67b885249b9204c45ade7c25ad16f

SHA1
e07ca6e16239723d181a87d006b933fcc62e3dc5

SHA256
d5806cc599329571b1e20a0e910cf7c8452719f9e7fd8fda0dfb4138370d0c06

SHA512
a31346b8e2f3ec6b1aa096c58d58a708c55e4a7c7bb6e183d1344d09a8cdd1f823f1572393d7cd016b290e4fc47921473ddc86820f31b4aea4e1e638e5d1cfd0

Download Submit
\??\c:\windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
189fddcd29aab2177bdb478636f3c427

SHA1
68eed55d100c5c4bdd90303d2f56d2963204d96f

SHA256
e39f0a1ea696fbde9b1417793a5f26d18bab297da9c10f9a8f13d1d1b5258695

SHA512
d5edd548ca77af6bfd3c5134316b31a7a6750ad423466969f294830dac0f7029d433987d755d64e5b9055a4bf5eda679a68b53d3f21d0f0da09ddb031dcc16dd

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
679KB

MD5
df0813141320a6fba0045d555aed095b

SHA1
21ecbfaa1a24603fd6d1b67429c89e98c58c4747

SHA256
ede5786c0fe65b3a39b65b78c3df6b7f9097d9adb034cccbc31dcf7e884fff8f

SHA512
d0d0bce69f648c5ac872211dce5aaa1c7ea4acfd03111535995325b0fb7d34e5c869c11f25a6ffdc9acd2c1f7485ba0e546273f66064542c30ffafa085b1429f

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
591KB

MD5
e575659836a1f029a938ad22da02442d

SHA1
397bfe05f34a00ad63ec14a288e8599cd405afb4

SHA256
7cfa64500503c677d5db0ae44fb2d21416e1782e77365a0e6eb5efe613c457db

SHA512
83d64b6a34b767b07965ecd1fe18cd228ae19351a1351f1c36c5fa4ed0fce72d133b2336f13637fd1b3171f001020870d2fd6b8dea181fcc1c0640261b554555

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
632KB

MD5
d529dcf45c7576c73999aa70a35242a1

SHA1
b41fdb80cceb84d450fcf336621397ef602a2245

SHA256
638857f740a573b9666d5a736b6cecab37c990420ddde9268eb5b13702c1c600

SHA512
b0b3d6c07bc573a74707aa51d4a9849346033983701e2ea95495ca057382345ed30c927fee8346ed327dc3a63420d08f146930250da854d00afed33eab2be1bc

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
c1b9abab22e7813a5a92534e1482901e

SHA1
f6940a8129627dba08ec644f0f41da97cf6e2c8a

SHA256
9c2c506b6f42fa2190346d028ed327d789b396c528cb15c3c6a35a2cf6a2a1ff

SHA512
38d6d164175d5ebafce9cb73fb69ced79b74aa416329df2ab7cce5ec215e0c3978a001182a2b619feedfd1705ceacbdf14d4a3315fa27ee9668b2aeab206b3ef

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
693KB

MD5
641f63eaa8fb743f047d95472479b4c5

SHA1
171480defda1b2cc5907b4e0907e85278ed50161

SHA256
68b05626ef0c38d128b67d3e6a21890c686b881b9b1ac14e2327893226ee3c0a

SHA512
a140e9bcb30133e4e0dea5f8d6ee184d4ae9593defa108d5f2e0f7db6b90a9e32a29e4c59f19cedb3d1886feb332a63da109c5d25d949171ba7e5e0f74e0425c

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
683KB

MD5
c911e2d12e460a85866058c8d072c097

SHA1
151d9ae4198082055625f419306960b3c4a94bd9

SHA256
44f46231db8e7e29fb3d388a4cb1378c8d177f7a81fdea0c4cdad5f36f24141f

SHA512
fe8d5f0fbdc16f50508d45c31a9322e3eb83364ff629b11f11df381de8d8e205b0188aa8b19ff80a125cc3f47649016baa33da7cb1530ebedc4105e400af9286

Download Submit
\??\c:\windows\system32\searchindexer.exe

Filesize
1.1MB

MD5
db3d6b79e4ba4bf634eb9786e30e6020

SHA1
bbf8b5a3ac2894395060250bfcc38ec37229eb52

SHA256
42ba3f286fd1c48949341afd5069c43124ba79d2afbdc7e65f54f96e1475c64c

SHA512
7bafdf8a279ffe27109731cd6534b3ff91f50d931127f446bc10d061951d03c0da28ba020cc466d6e7477dcb907ac5e616575b1612ce56f6ac38309583319e73

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
569KB

MD5
714540f7854da30ff65d1c6fc34a827d

SHA1
9c4e2ff37faed1c70fc2c10107aabe6a57ad387f

SHA256
54201a74123890f5c6fb25cd59d9d72f9673edd5bed2dcb62e3e003ad78b8de9

SHA512
a274341cb3e6644c510b993e614932c6dc0d1a1ed5a8b4527b93db40feb1c8f153fb210e47ee84397bd63ce1f1c51c7d0f9a2ee2e227c537353604680797fa71

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
595KB

MD5
045922dad1b1880dcf4406b96f28c2f2

SHA1
bdd9d5fbcd3f584b32beeb840cb326c0e7709371

SHA256
735cca8cd5f049ce9b5024e496b880498dd9c2c157ed002fa7a3c2569c3d2d8a

SHA512
8d483c9e0d11924c6c2ddfafae4190698f1d249bed8d4b88885e0d6b91680fec35192f3304a3fa790fa1d4d393c9379cdc8cf9df698088d604ef15e32af33400

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.1MB

MD5
231510b26cda459588f83efc98c3602c

SHA1
914071cddd9dbfde68880c8b8107daade2cff863

SHA256
814aa232afece97c22881462a072f1f8418a8fc8424884ea3b3dd0990791bbb4

SHA512
f5d2d5393d05303f99c885cab2b9106f7548ceeb702dd07a7b088d48c071c29cf135274e42e7ba5fb12800579bef5a12329ee43ee6b67aab5b5f26c20ba427b1

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.1MB

MD5
5d1ff3ff3ec5460f1fc1e7b9731a409e

SHA1
2f34bbf190198b4698f4f6eaf2a181c930f160e3

SHA256
0a297f4bad823d4491a2a758519e8f2daa116671daa633d6e51eb05b00eafab2

SHA512
029c26a611ab56e0538866f5259fb4dd6f8a1589f277d802a66269ff814727d018b21d0dbc520e0a0b989e7bbcc5e5c186911c7c155f8b6c2b0a5c9e4c51d342

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
753KB

MD5
cf605e009eea3f965838f0803dcd27b3

SHA1
e613440b0d14759592bcaf59299f2e8fea57d25e

SHA256
a2b460cde00e0f1c4167e7e801bce60938243ad1637aee0be3891e9628c1578b

SHA512
f4f7239ec39523791321d5b91c6d36c7dd746a9f158f8b4aab518b1d206b7d83bad62aa30a78bd6f6219c8f515ecd9b10e17e0c15e26272b2bfd6ac35a26ef66

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.0MB

MD5
bcbf805f54dd9eebd572caaa4f029bae

SHA1
bf8a6b9dcdc267293bf62b49be0035e3f27fb538

SHA256
5314dc10207e501d8736809b817d3d3270de94374896b399ee0ad4ea06a4d980

SHA512
596252b2c0d3bf29d4600b322bbf8f04a1b0777624ac66aa48fa61f1a1a9875ac7e19ceea5954619f30717177547ea89264ff0eee72df613838c00d6ddc759cf

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
666KB

MD5
fe2d2b29e928e6b916c12a222a6d2d4e

SHA1
0b9de2630e4e139649a98d64b6f09693df17846c

SHA256
a03a1441281e2816ec1a944353becc7b93e3362c6a59dde2f9fec7826fa769a8

SHA512
e912aebd4b5d823f2f5d844ce2e6e33295a85cd50859b95fb0634c25d12f560fd4536d25db389bc654a2dcc32cd5a72894d0f5f0b350df2242707af680b5814c

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP83EF.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP864F.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP895B.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8CB5.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8EF7.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9147.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
memory/320-483-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/568-185-0x0000000140000000-0x0000000140292000-memory.dmp

Filesize
2.6MB

Download
memory/568-93-0x0000000140000000-0x0000000140292000-memory.dmp

Filesize
2.6MB

Download
memory/568-247-0x0000000140000000-0x0000000140292000-memory.dmp

Filesize
2.6MB

Download
memory/924-466-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/924-453-0x00000000007F0000-0x0000000000806000-memory.dmp

Filesize
88KB

Download
memory/924-457-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/924-458-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/1060-346-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/1060-345-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/1060-348-0x0000000000600000-0x0000000000616000-memory.dmp

Filesize
88KB

Download
memory/1060-347-0x0000000000960000-0x00000000009A8000-memory.dmp

Filesize
288KB

Download
memory/1060-353-0x00000000031B0000-0x00000000031BE000-memory.dmp

Filesize
56KB

Download
memory/1060-352-0x00000000031B0000-0x00000000031BE000-memory.dmp

Filesize
56KB

Download
memory/1060-362-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1144-163-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1144-187-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1228-179-0x0000000140000000-0x000000014041B000-memory.dmp

Filesize
4.1MB

Download
memory/1228-86-0x0000000140000000-0x000000014041B000-memory.dmp

Filesize
4.1MB

Download
memory/1296-46-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/1404-341-0x0000000002FF0000-0x0000000003006000-memory.dmp

Filesize
88KB

Download
memory/1404-338-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/1404-339-0x0000000000870000-0x000000000087C000-memory.dmp

Filesize
48KB

Download
memory/1404-343-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1404-340-0x0000000000890000-0x00000000008D8000-memory.dmp

Filesize
288KB

Download
memory/1456-335-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1496-467-0x0000000002F10000-0x0000000002F1E000-memory.dmp

Filesize
56KB

Download
memory/1496-469-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1612-471-0x00000000008C0000-0x00000000008CE000-memory.dmp

Filesize
56KB

Download
memory/1612-482-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1612-474-0x0000000003070000-0x000000000307E000-memory.dmp

Filesize
56KB

Download
memory/1616-188-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1616-186-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1628-398-0x00000000031D0000-0x00000000031DE000-memory.dmp

Filesize
56KB

Download
memory/1628-396-0x0000000002F60000-0x0000000002F7A000-memory.dmp

Filesize
104KB

Download
memory/1628-395-0x00000000008C0000-0x00000000008CC000-memory.dmp

Filesize
48KB

Download
memory/1628-394-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1628-397-0x00000000031B0000-0x00000000031C0000-memory.dmp

Filesize
64KB

Download
memory/1628-401-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1748-161-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1748-57-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1748-58-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download
memory/1764-449-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/1764-448-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/1764-451-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1808-374-0x000000001C4A0000-0x000000001C4B6000-memory.dmp

Filesize
88KB

Download
memory/1808-371-0x0000000000940000-0x0000000000958000-memory.dmp

Filesize
96KB

Download
memory/1808-385-0x000000001D1C0000-0x000000001D1D8000-memory.dmp

Filesize
96KB

Download
memory/1808-384-0x000000001D1C0000-0x000000001D1D8000-memory.dmp

Filesize
96KB

Download
memory/1808-377-0x000000001CA00000-0x000000001CA1E000-memory.dmp

Filesize
120KB

Download
memory/1808-376-0x000000001C510000-0x000000001C52A000-memory.dmp

Filesize
104KB

Download
memory/1808-375-0x000000001C4C0000-0x000000001C508000-memory.dmp

Filesize
288KB

Download
memory/1808-372-0x0000000003120000-0x000000000312C000-memory.dmp

Filesize
48KB

Download
memory/1808-373-0x0000000003130000-0x000000000313E000-memory.dmp

Filesize
56KB

Download
memory/1808-393-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2220-330-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2220-332-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2244-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2244-0-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/2244-2-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/2356-337-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2356-334-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2360-365-0x00000000006E0000-0x00000000006EE000-memory.dmp

Filesize
56KB

Download
memory/2360-363-0x00000000006A0000-0x00000000006B8000-memory.dmp

Filesize
96KB

Download
memory/2360-366-0x0000000000870000-0x000000000088A000-memory.dmp

Filesize
104KB

Download
memory/2360-367-0x0000000003180000-0x000000000319E000-memory.dmp

Filesize
120KB

Download
memory/2360-369-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2528-21-0x0000000010000000-0x0000000010258000-memory.dmp

Filesize
2.3MB

Download
memory/2528-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2528-54-0x0000000010000000-0x0000000010258000-memory.dmp

Filesize
2.3MB

Download
memory/2584-425-0x00000000008D0000-0x00000000008DE000-memory.dmp

Filesize
56KB

Download
memory/2584-430-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2584-426-0x00000000008E0000-0x00000000008F4000-memory.dmp

Filesize
80KB

Download
memory/2584-424-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/2684-431-0x0000000000680000-0x000000000068C000-memory.dmp

Filesize
48KB

Download
memory/2684-428-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2684-432-0x0000000000830000-0x000000000083C000-memory.dmp

Filesize
48KB

Download
memory/2684-447-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2684-433-0x00000000009D0000-0x00000000009E4000-memory.dmp

Filesize
80KB

Download
memory/2684-438-0x0000000003110000-0x000000000311C000-memory.dmp

Filesize
48KB

Download
memory/2684-437-0x0000000003110000-0x000000000311C000-memory.dmp

Filesize
48KB

Download
memory/2744-38-0x0000000010000000-0x000000001028B000-memory.dmp

Filesize
2.5MB

Download
memory/2744-35-0x0000000010000000-0x000000001028B000-memory.dmp

Filesize
2.5MB

Download
memory/2744-63-0x0000000010000000-0x000000001028B000-memory.dmp

Filesize
2.5MB

Download
memory/2788-414-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2788-405-0x000000001C490000-0x000000001C49C000-memory.dmp

Filesize
48KB

Download
memory/2788-404-0x0000000002F40000-0x0000000002F58000-memory.dmp

Filesize
96KB

Download
memory/2788-406-0x000000001C4A0000-0x000000001C4AE000-memory.dmp

Filesize
56KB

Download
memory/2788-400-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2788-410-0x000000001C540000-0x000000001C550000-memory.dmp

Filesize
64KB

Download
memory/2788-423-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2788-415-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

Filesize
48KB

Download
memory/2788-409-0x000000001C520000-0x000000001C53A000-memory.dmp

Filesize
104KB

Download
memory/2788-408-0x000000001C4D0000-0x000000001C518000-memory.dmp

Filesize
288KB

Download
memory/2788-403-0x0000000000950000-0x000000000095C000-memory.dmp

Filesize
48KB

Download
memory/2788-407-0x000000001C4B0000-0x000000001C4C6000-memory.dmp

Filesize
88KB

Download