expiro | ff64a71a691503ac8312b3260675e2ff01b58ed650c8bf001e811e6de50fd366

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
Size

706KB
MD5

7b14e1aeafa5022fc960f5f995c45b10
SHA1

03e392602e849b01b8a8416088b540fae0fe3a9c
SHA256

ff64a71a691503ac8312b3260675e2ff01b58ed650c8bf001e811e6de50fd366
SHA512

65c548022ec636379b8d0fd436add94d94e8c40a1ad1cb1f8dbbb1dab9956ccef55af794476856fb9b0777e2fa2c4addc39bb7214c6771d0c8b1d2f5839d1096
SSDEEP

12288:TvqlqSrzEAupLiPuSrN0yMaT79+DFva/wQZsJiuyxhtyI/MhVl1cJ6Q5joTeRH6R:rsqSroAupL8uSrOyM2+DFva/wQZsJiv4

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 3 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2000-2-0x0000000001000000-0x00000000011D4000-memory.dmp	family_expiro1
behavioral1/memory/1868-54-0x0000000010000000-0x00000000101AF000-memory.dmp	family_expiro1
behavioral1/memory/1668-95-0x0000000140000000-0x0000000140377000-memory.dmp	family_expiro1

Executes dropped EXE 64 IoCs

pid	Process
1868	mscorsvw.exe
476	Process not Found
2756	mscorsvw.exe
2820	mscorsvw.exe
1880	mscorsvw.exe
1668	elevation_service.exe
2076	IEEtwCollector.exe
1404	mscorsvw.exe
828	mscorsvw.exe
2296	mscorsvw.exe
1636	mscorsvw.exe
1696	mscorsvw.exe
2164	mscorsvw.exe
2148	mscorsvw.exe
1600	mscorsvw.exe
1800	mscorsvw.exe
2412	mscorsvw.exe
1712	mscorsvw.exe
1652	mscorsvw.exe
2504	mscorsvw.exe
2732	mscorsvw.exe
2924	mscorsvw.exe
2720	mscorsvw.exe
2664	mscorsvw.exe
768	mscorsvw.exe
2588	mscorsvw.exe
1232	mscorsvw.exe
2872	mscorsvw.exe
2636	mscorsvw.exe
1296	mscorsvw.exe
1896	mscorsvw.exe
2384	mscorsvw.exe
1408	mscorsvw.exe
2456	mscorsvw.exe
1872	mscorsvw.exe
2316	mscorsvw.exe
1448	mscorsvw.exe
2252	mscorsvw.exe
2688	mscorsvw.exe
2676	mscorsvw.exe
1736	mscorsvw.exe
1688	mscorsvw.exe
2892	mscorsvw.exe
2164	mscorsvw.exe
568	mscorsvw.exe
1920	mscorsvw.exe
904	mscorsvw.exe
2352	mscorsvw.exe
1712	mscorsvw.exe
2300	mscorsvw.exe
636	mscorsvw.exe
2096	mscorsvw.exe
2800	mscorsvw.exe
2720	mscorsvw.exe
580	mscorsvw.exe
3004	mscorsvw.exe
2832	mscorsvw.exe
2560	mscorsvw.exe
2528	mscorsvw.exe
1264	mscorsvw.exe
2884	mscorsvw.exe
2508	mscorsvw.exe
2296	mscorsvw.exe
2132	mscorsvw.exe

Loads dropped DLL 62 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
2148	mscorsvw.exe
2148	mscorsvw.exe
1800	mscorsvw.exe
1800	mscorsvw.exe
1712	mscorsvw.exe
1712	mscorsvw.exe
2504	mscorsvw.exe
2504	mscorsvw.exe
2924	mscorsvw.exe
2924	mscorsvw.exe
2664	mscorsvw.exe
2664	mscorsvw.exe
2588	mscorsvw.exe
2588	mscorsvw.exe
2872	mscorsvw.exe
2872	mscorsvw.exe
1296	mscorsvw.exe
1296	mscorsvw.exe
2384	mscorsvw.exe
2384	mscorsvw.exe
2456	mscorsvw.exe
2456	mscorsvw.exe
2316	mscorsvw.exe
2316	mscorsvw.exe
2252	mscorsvw.exe
2252	mscorsvw.exe
2676	mscorsvw.exe
2676	mscorsvw.exe
1688	mscorsvw.exe
1688	mscorsvw.exe
2164	mscorsvw.exe
2164	mscorsvw.exe
2300	mscorsvw.exe
2300	mscorsvw.exe
636	mscorsvw.exe
636	mscorsvw.exe
2800	mscorsvw.exe
2800	mscorsvw.exe
1316	mscorsvw.exe
1316	mscorsvw.exe
2480	mscorsvw.exe
2480	mscorsvw.exe
2980	mscorsvw.exe
2980	mscorsvw.exe
2284	mscorsvw.exe
2284	mscorsvw.exe
344	mscorsvw.exe
344	mscorsvw.exe
2904	mscorsvw.exe
2904	mscorsvw.exe
1016	mscorsvw.exe
1016	mscorsvw.exe
1020	mscorsvw.exe
1020	mscorsvw.exe
1748	mscorsvw.exe
1748	mscorsvw.exe
828	mscorsvw.exe
828	mscorsvw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3533259084-2542256011-65585152-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3533259084-2542256011-65585152-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\G:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\I:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\W:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\Z:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\M:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\N:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\O:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\P:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\Q:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\X:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\R:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\S:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\H:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\J:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\K:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\V:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\E:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\L:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\T:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\U:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\Y:	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\ui0detect.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\alg.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\vds.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\system32\vssvc.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	mscorsvw.exe
File created	C:\Program Files\Internet Explorer\iexplore.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\7-Zip\7z.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	mscorsvw.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	mscorsvw.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15e.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8B9D.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15e.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA5C1.tmp\ehiVidCtl.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPC87D.tmp\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP9B84.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPAA15.tmp\stdole.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15f.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index160.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.vir	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP953D.tmp\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPAC65.tmp\ehiActivScp.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index15a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8298.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1C09.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe
1880	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2000	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe
Token: SeShutdownPrivilege	1880	mscorsvw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2000	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
2000	JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1404	1880	mscorsvw.exe	37
PID 1880 wrote to memory of 1404	1880	mscorsvw.exe	37
PID 1880 wrote to memory of 1404	1880	mscorsvw.exe	37
PID 1880 wrote to memory of 828	1880	mscorsvw.exe	38
PID 1880 wrote to memory of 828	1880	mscorsvw.exe	38
PID 1880 wrote to memory of 828	1880	mscorsvw.exe	38
PID 1880 wrote to memory of 2296	1880	mscorsvw.exe	41
PID 1880 wrote to memory of 2296	1880	mscorsvw.exe	41
PID 1880 wrote to memory of 2296	1880	mscorsvw.exe	41
PID 1880 wrote to memory of 1636	1880	mscorsvw.exe	42
PID 1880 wrote to memory of 1636	1880	mscorsvw.exe	42
PID 1880 wrote to memory of 1636	1880	mscorsvw.exe	42
PID 1880 wrote to memory of 1696	1880	mscorsvw.exe	43
PID 1880 wrote to memory of 1696	1880	mscorsvw.exe	43
PID 1880 wrote to memory of 1696	1880	mscorsvw.exe	43
PID 1880 wrote to memory of 2164	1880	mscorsvw.exe	44
PID 1880 wrote to memory of 2164	1880	mscorsvw.exe	44
PID 1880 wrote to memory of 2164	1880	mscorsvw.exe	44
PID 1880 wrote to memory of 2148	1880	mscorsvw.exe	45
PID 1880 wrote to memory of 2148	1880	mscorsvw.exe	45
PID 1880 wrote to memory of 2148	1880	mscorsvw.exe	45
PID 1880 wrote to memory of 1600	1880	mscorsvw.exe	46
PID 1880 wrote to memory of 1600	1880	mscorsvw.exe	46
PID 1880 wrote to memory of 1600	1880	mscorsvw.exe	46
PID 1880 wrote to memory of 1800	1880	mscorsvw.exe	47
PID 1880 wrote to memory of 1800	1880	mscorsvw.exe	47
PID 1880 wrote to memory of 1800	1880	mscorsvw.exe	47
PID 1880 wrote to memory of 2412	1880	mscorsvw.exe	48
PID 1880 wrote to memory of 2412	1880	mscorsvw.exe	48
PID 1880 wrote to memory of 2412	1880	mscorsvw.exe	48
PID 1880 wrote to memory of 1712	1880	mscorsvw.exe	49
PID 1880 wrote to memory of 1712	1880	mscorsvw.exe	49
PID 1880 wrote to memory of 1712	1880	mscorsvw.exe	49
PID 1880 wrote to memory of 1652	1880	mscorsvw.exe	50
PID 1880 wrote to memory of 1652	1880	mscorsvw.exe	50
PID 1880 wrote to memory of 1652	1880	mscorsvw.exe	50
PID 1880 wrote to memory of 2504	1880	mscorsvw.exe	51
PID 1880 wrote to memory of 2504	1880	mscorsvw.exe	51
PID 1880 wrote to memory of 2504	1880	mscorsvw.exe	51
PID 1880 wrote to memory of 2732	1880	mscorsvw.exe	52
PID 1880 wrote to memory of 2732	1880	mscorsvw.exe	52
PID 1880 wrote to memory of 2732	1880	mscorsvw.exe	52
PID 1880 wrote to memory of 2924	1880	mscorsvw.exe	53
PID 1880 wrote to memory of 2924	1880	mscorsvw.exe	53
PID 1880 wrote to memory of 2924	1880	mscorsvw.exe	53
PID 1880 wrote to memory of 2720	1880	mscorsvw.exe	54
PID 1880 wrote to memory of 2720	1880	mscorsvw.exe	54
PID 1880 wrote to memory of 2720	1880	mscorsvw.exe	54
PID 1880 wrote to memory of 2664	1880	mscorsvw.exe	55
PID 1880 wrote to memory of 2664	1880	mscorsvw.exe	55
PID 1880 wrote to memory of 2664	1880	mscorsvw.exe	55
PID 1880 wrote to memory of 768	1880	mscorsvw.exe	56
PID 1880 wrote to memory of 768	1880	mscorsvw.exe	56
PID 1880 wrote to memory of 768	1880	mscorsvw.exe	56
PID 1880 wrote to memory of 2588	1880	mscorsvw.exe	57
PID 1880 wrote to memory of 2588	1880	mscorsvw.exe	57
PID 1880 wrote to memory of 2588	1880	mscorsvw.exe	57
PID 1880 wrote to memory of 1232	1880	mscorsvw.exe	58
PID 1880 wrote to memory of 1232	1880	mscorsvw.exe	58
PID 1880 wrote to memory of 1232	1880	mscorsvw.exe	58
PID 1880 wrote to memory of 2872	1880	mscorsvw.exe	59
PID 1880 wrote to memory of 2872	1880	mscorsvw.exe	59
PID 1880 wrote to memory of 2872	1880	mscorsvw.exe	59
PID 1880 wrote to memory of 2636	1880	mscorsvw.exe	60

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b14e1aeafa5022fc960f5f995c45b10.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1868

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 15c -NGENProcess 160 -Pipe 16c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 214 -NGENProcess 160 -Pipe 170 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1e0 -NGENProcess 180 -Pipe 158 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 260 -NGENProcess 168 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 248 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 180 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 168 -Pipe 14c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 180 -NGENProcess 168 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 254 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 270 -NGENProcess 1e0 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 180 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 264 -NGENProcess 180 -Pipe 110 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 288 -NGENProcess 1e0 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1e0 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 290 -NGENProcess 180 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 180 -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 180 -InterruptEvent 298 -NGENProcess 280 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 280 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 288 -NGENProcess 298 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a8 -NGENProcess 290 -Pipe 180 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 290 -NGENProcess 2a0 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2b0 -NGENProcess 298 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 298 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2b8 -NGENProcess 2a0 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2a0 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 2a8 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a8 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2b8 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 2c8 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2c0 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2fc -NGENProcess 2d8 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2c0 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2300
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2d8 -NGENProcess 300 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 308 -NGENProcess 30c -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2d8 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 31c -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2fc -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2d8 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2e8 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2fc -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2d8 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2e8 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2fc -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2d8 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2e8 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2fc -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2d8 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:2272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2e8 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:1296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2fc -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2d8 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:1452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2e8 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 34c -NGENProcess 2fc -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 344 -NGENProcess 35c -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 364 -NGENProcess 2e8 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 2fc -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 35c -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 2e8 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 34c -NGENProcess 2fc -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 2fc -NGENProcess 36c -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 378 -NGENProcess 2e8 -Pipe 168 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 374 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 36c -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 2e8 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:2700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 374 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 36c -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 2e8 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 374 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 36c -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:2836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 38c -NGENProcess 2e8 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 384 -NGENProcess 39c -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 3a4 -NGENProcess 36c -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 2e8 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:2900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 39c -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 36c -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:1936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 2e8 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 39c -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 36c -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:1744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 2e8 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 39c -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 36c -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:2104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 2e8 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:1756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 39c -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 36c -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 2e8 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 39c -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 36c -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 2e8 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 39c -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 36c -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 36c -NGENProcess 3e4 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 3dc -NGENProcess 39c -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3ec -NGENProcess 3f4 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 2e4 -NGENProcess 39c -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 39c -NGENProcess 374 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:1232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3fc -NGENProcess 3f4 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3f4 -NGENProcess 2e4 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 408 -NGENProcess 374 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:2904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 374 -NGENProcess 3fc -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  PID:2136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 410 -NGENProcess 2e4 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 40c -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 3fc -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  PID:1844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 2e4 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 40c -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 3fc -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 2e4 -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 40c -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:2076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 3fc -NGENProcess 428 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:1140
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 438 -NGENProcess 420 -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:2752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 2e4 -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  PID:2812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 428 -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 420 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 2e4 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 428 -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 450 -NGENProcess 420 -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:2996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 454 -NGENProcess 2e4 -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 458 -NGENProcess 428 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:2748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 45c -NGENProcess 420 -Pipe 444 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 41c -NGENProcess 420 -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 46c -NGENProcess 428 -Pipe 468 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 428 -NGENProcess 464 -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  PID:688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 474 -NGENProcess 450 -Pipe 46c -Comment "NGen Worker Process"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 478 -NGENProcess 470 -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 470 -NGENProcess 428 -Pipe 464 -Comment "NGen Worker Process"
  2⤵
  PID:1304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 480 -NGENProcess 450 -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 484 -NGENProcess 47c -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 488 -NGENProcess 428 -Pipe 474 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 428 -NGENProcess 480 -Pipe 450 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 490 -NGENProcess 47c -Pipe 478 -Comment "NGen Worker Process"
  2⤵
  PID:112

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1668

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

Filesize
636KB

MD5
63c391293658eb95cf3c557152d41bd4

SHA1
7f4c36684244b7bc3cedabf1f7b5e9c0a231c1f6

SHA256
b6eaa99158d70d504b873653e860fbc59e5a8b5bcdac698efac260fbc0cd68a1

SHA512
89e7ca3e64f882617c6f18fbf74a290c57bc75498a32e5a06dbb229488da0458b77a4e665f95db49db9ca05c0a6242dbbbcdbbd40244effbae8c21bfc847ba9f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.5MB

MD5
883f26ef1371ae6006d74ca84da0e4b7

SHA1
3259a323c8f1efdd344831b2374e205858d26296

SHA256
f1c2257520a7dcd4195279d82e3a538933aecc9bf1f86f5f4c75338030b7e29e

SHA512
cd33aefee8b386bc52aee818fc657dc28b3f0e24a1e1e4d14b862c6b178695c4fd01ce062ecb8ca820b08f9919edee56412b7f87749061fd65a50d5171ee6db8

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
3d8f3243172d4a83fbf54f2e86f5b872

SHA1
81d53e860dc5de3dc6dd589d2c51a9d3413ae8aa

SHA256
6d40b2bd65f075eb2bea2b9c3c0595143946d2ead4102c558e524b5edcbbdb64

SHA512
288fd92f9d65741f5d3dde17ae52b8e7266fca1fa6d2a966ffda070e73d9ce049e6f2681db630d18a1be721f818490ccf1736344acb3c37a3a3adb3a23e6c872

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.2MB

MD5
5ac5b4a5099ea3a9b32f67de7532da9c

SHA1
c2b1e4d2db6ff7a8bd3a0dd078315f918ee105d4

SHA256
0829ead7a5d112c6a5d34e83762031aae97432cd50f1bb822aa88b7fe336bee0

SHA512
3f964a272ebace33f49e4c0daca158af97d55b1c396d51864167004d51a3d83997662c882611e4d6f7c64c8d882f80fdcf4bed1976471ecc28a23f5f733eca8a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
578KB

MD5
3b8d4eca93f181638c5129cb9e13209f

SHA1
8a233c797c3321a2813160bd6a33ed6954c109c1

SHA256
6e3972ed53e4318b958df16cfda0506bf9b99e1338828d838081e52a9e8de3e7

SHA512
2d25efbcec52fc84c98fc805d3f2cfbf045e67ae228ae5f570bc121dfe4f4e50fb86ee748d5b3e3aeedc9441915c16262f54c3f120a3bbc6366dff5242ac9729

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
347bf12b291b4a96dfdedbb80883f2ae

SHA1
3c2ba176d5c8f36e5d8048ee32895386d7784b1f

SHA256
4e806e397a1fa14ef714010ade4bb8c7edd4f251f81a834b902724b056f455fa

SHA512
bb61785a8d359f5dcd48d9ffe2c7ce8d47aeede43fad271b290ed14ef4b9b86a74825a8d67c172f6e0979e549a9407823de356eb23051e8862f1cd3f4841e197

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
606KB

MD5
24cdd76c9ab60293a7576392c2a94142

SHA1
64e3cb5ead7d135736472eeccd8c2934289f6d37

SHA256
312f223b3317bccbec3201bd3ac42be4e8535e3f39c55843829adc3f68cd3834

SHA512
29227bb964e08e9e2eef9ca6a6f730a7698dbc45257cb3ae7295ab4972f7d013c78c81832714f7502c1076c3bbb29778347c3ea0ce92908b00bede430b6bf88e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
4f12d8b8cb1deb4cff9e482548f2964b

SHA1
c16ec1fc4167acfff6923e8f263baba564236bb3

SHA256
e03d0ffb94a361a36ecc1ac7a097b8403c2b49ededc70a5222e02bf81a8c3d4c

SHA512
23e446a1d10e6aa9e12be003660ba06bee7fa07ba4dfa6115b324d463a153bd0e9eb93d9f1e1d181f3a99c0eadd427d563cb4545d0283f92cffbddd919f49c65

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
555KB

MD5
8500312fc239d96d89f889003d5efb0b

SHA1
034f7b3676bdb1909ae25d702a4d2fec765368ed

SHA256
b4617a2dcd89e660b1295ae4f6017decec1d4cc751e26b0ef5156e4a2225f98b

SHA512
7365ac1fb356638f50775c45a8107cfba8e75d8c2a021b2aae7242c95dba635dfcc4dc9c7eaf050ac9c1dabab8c5eb7858a2871a706406ef6f389bf145be1aab

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
69daaee11f97b6bce942a4ad5e88b786

SHA1
68b49a5e007998994bc1a64efe83f1b6c6142ffe

SHA256
e70dafaac9d152a00b779e5d485db16dbfe4ad3371935ce96f7857848956565b

SHA512
9eb7942e2e34086d52e25d3e3e93141985aa1c6a928ea21322faea1d0a16aa6e25502f47589f719dd70eb7089fe3888f5c1efd31de5865546d46b1dbf9de22cb

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
586KB

MD5
742f5713b8f76928a7371f68c276d564

SHA1
98c633f9ab5bae2d336d7f89666e36e227df43d2

SHA256
23ae65d9dd811e85109815b2c731682179fd3fb9d6bec196845bf4ad4577b041

SHA512
21943821d8159f67fc6df5a780b58ba0904d07db56479f900078bf9331e1fd3b356b798e580f9ee6def50860a353365f64042a96dc61d8c7e34cc92aa50c0238

Download Submit
C:\Windows\Temp\CabEC04.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarED8C.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Filesize
91KB

MD5
adc5887e89bc56694a193d92898d3518

SHA1
267f14c45a86d50ad627c6cb00626049e9c1ee20

SHA256
edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b

SHA512
bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\52a86a4b96d5a99fd1e35198e51be22c\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
aeae144e45c0be120ddba3eb42f43745

SHA1
6cebe2a10635a2e8840e5c4bfe158d5aeec3b38a

SHA256
f62421ea775ac785a14c09d56df97e6862ed0a8f2f7430b3aa0cf9c27bab8b86

SHA512
1542facfc00ff22e3f0de653414be8711d84bdd619cfc74bad1760cbb088b3404cc54db5591956855b831f5c03604aab9476a605b962587f99c5b2faa9eb0a6d

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Filesize
1.8MB

MD5
04a6857c04546270358d14398fde209e

SHA1
596a3e11ac6c303c679edfd6c30aa71e8eaf8a23

SHA256
8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285

SHA512
4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\944266c3e3b4a733c563ee52096c76fd\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
8e364b2f35dbe9ce42d54e7fb22725f6

SHA1
b3427492680937d38877ce9ca18a962f5a17c0ba

SHA256
10989203402f98964f080e938fe0078857200c305547e6a0f72eb31c5aef2fef

SHA512
2448920f87437d1612fb71fb1e69568ed1b7492eb9d184dff72c81fce6589ec515c038588859334612bfff5683b484a211b43fac19634033134dcdc95eff0814

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Filesize
483KB

MD5
aae5a97685a809d0a0f661f9319f8a12

SHA1
b5fdd4ec4cc057fccc868de4f4910be89e23e48a

SHA256
c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233

SHA512
d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\df217596eb4a3759a667e1dc95c67b4b\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
c32e1ccc9579f24124f34da6ac9cad4a

SHA1
9225ce9ae0ee333ab95c12b23463a26b521bf75a

SHA256
fcc644fb732c0a54abe35a0cc0a06784925b95386949de14a285e6fbfad6595c

SHA512
cf9470dfb23b3b0f3563559e020b27e18ca15c53951b51f9d7717a90c607ae0a3cef676dbbdc8afa74009f53f5cf4fc6be492e0d3bd072adb8aec8e54e2aa1ca

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\e20dd5f86988fd0600b83b95440ad6b2\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
f90b7f9e3ccba64b2064a649e5e2ac54

SHA1
e6197cef773a98ff460bca6c075152c4ccd3b18d

SHA256
b3ec6b52ee9a90e9fef1cc93a0c102fa42c848116bfc00c92f20cc4a73a4588e

SHA512
d3cd16db5b8aa43ffa2d63a0a993c674299023e862c0f1aca9218435a053d885f374c46386bd9be3b795e8c1246909a1a98f4881181f88867a58abb3e111618c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
636KB

MD5
11236ae6d53606da33184bcf784a2a1f

SHA1
64382b66820f52eb747bf2d19b72026431700f2c

SHA256
3f470575b27c133cfdde7ae31992537cd6ca25fedba08eb7084a8c6fcbb8680e

SHA512
70f5fad92677ea97f0f5af8b66c40b20ba5e985b21cf10346ccabb58e35953bbd3b3be0193b3e19fa00b4822995890d2884c6179a7a90d02a4813303ad1dfe4d

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
711KB

MD5
7047243355a2a8ed58b676f3e9225b5e

SHA1
8a54131752323c69f2ddcd43be37eb6f97349a13

SHA256
228639f66580bbde9aa54cb4501845d72afb599af53b91bf564bf9fcbb685b3c

SHA512
09f8a52247b47f2d7ae9480e9a6f101bae4d694355e8c5225dd69a17b64c4e0c52d88c5ec6a021b11b99f779f89e465ab666085183ce85a10ac0e3cf03f8e6e9

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
620KB

MD5
17f7d547943f48d357d86dc85345dc08

SHA1
4c7f935cf38ea4a4cf056f21393a8ef4bf5afc23

SHA256
ca1a47386b22e5f0f56f8c021f55b67479ad5d89962923a7e3c66f1a34822bfc

SHA512
a7a33f9990073af200c4fc7ddfb335f3dfe01d38719c79c29fd2cda66f140a2f7bd6945366318edcbbc53c60608ecdea8fea1ca9c86248f9235dd0eb63de9416

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
532KB

MD5
f8ac7e11a2637f428ea3812425b1b494

SHA1
c19247e0ccb77edbf2d76994606f3d2adddd9766

SHA256
6ba18f8ea2277aa3a479635baf4c57ca1c9f841dd9a6f7a3fc8108592e883e5e

SHA512
269cf2b875f56bef8548c85f98f43756ef289bd84718207a05aac406e5135f518c1ab1a470fc4847b57e70b074bf9b73a8d6d3246be0f18d52135fc03943fb87

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
573KB

MD5
bf66b90a9f18d20354ae7d4f66f9982e

SHA1
5984e466bf1ddf3eb41f5551b1eb6bb3998de42e

SHA256
18afc5aba25e9364d195f0232df034ea336f0386034849d2f8afec8d475f76a9

SHA512
398e041ef3befe4b6cd4c602fb8bdbe4658b66c79cd23bedc938232e6959f0f521a7b4b43368d4efd12783b737baa8f3509d4165705f410ab50e7eec3a4487e7

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.1MB

MD5
3afe483a6133f8782b0987be91b4e278

SHA1
a31ba117646f8c8886c7be52e1e10123916ff952

SHA256
19d3dfbf518265b5de1a8b006f74011f70aaf89870a49a1a6f516ed7578d5ad9

SHA512
b21a73430ab5ed5d5771ff3917fcd10c7151b2ef214f83cdca5452ac8be9b08abcf605ce1b6ac7f05bfb2936d954bd43c96e7250eae5a996b17a6e4b9b9108e5

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
edff973793653f302ea6194156f70385

SHA1
3b310192137c56abce475a1b5ff4b9b2140e640f

SHA256
ab6b1c0610eaf5a3200da0d809490c70cb9cc4c68c4ff593da023c39111f6a5e

SHA512
0c00c27b210d921bde3c3eae9120395e8fc13c0bfe10c893ab98ec31a9fb0d7db7558e32f000f7526f445d3687c61161fe804f000ff588bf2813460a889a7f2d

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
605KB

MD5
0d665fc6e3956453af9cd4aef6fff807

SHA1
0cb9e86714fc211977cf88254ba95a85cd842f72

SHA256
824bd170b6872141b4ea18289dbe2f3945d4b4202200283d6725c460bbc68c9b

SHA512
b3faf54ae66ab799d6311dacf8eec2adce3f4cd524cecdb5ad8f99795ef782a6f02f7812d7a085c8bdcb17576e2c3f8e46e88e5461856ad5d68a644a131bab46

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP74F1.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP77DE.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7B29.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7D6A.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7FDA.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8298.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP84D9.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8739.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
memory/768-439-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/768-445-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/828-138-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/828-165-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1232-460-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1404-93-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1404-143-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1600-320-0x00000000006B0000-0x00000000006C8000-memory.dmp

Filesize
96KB

Download
memory/1600-322-0x0000000000920000-0x000000000092E000-memory.dmp

Filesize
56KB

Download
memory/1600-323-0x00000000030C0000-0x00000000030DA000-memory.dmp

Filesize
104KB

Download
memory/1600-324-0x00000000030E0000-0x00000000030FE000-memory.dmp

Filesize
120KB

Download
memory/1600-326-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1636-291-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1652-381-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1652-379-0x000000001C530000-0x000000001C544000-memory.dmp

Filesize
80KB

Download
memory/1652-378-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Filesize
48KB

Download
memory/1668-95-0x0000000140000000-0x0000000140377000-memory.dmp

Filesize
3.5MB

Download
memory/1668-82-0x0000000140000000-0x0000000140377000-memory.dmp

Filesize
3.5MB

Download
memory/1696-293-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1712-368-0x00000000030E0000-0x00000000030EC000-memory.dmp

Filesize
48KB

Download
memory/1712-369-0x00000000030E0000-0x00000000030EC000-memory.dmp

Filesize
48KB

Download
memory/1712-358-0x00000000007B0000-0x00000000007BC000-memory.dmp

Filesize
48KB

Download
memory/1712-364-0x0000000002FF0000-0x0000000003000000-memory.dmp

Filesize
64KB

Download
memory/1712-359-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/1712-360-0x0000000002FC0000-0x0000000002FCE000-memory.dmp

Filesize
56KB

Download
memory/1712-377-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1712-361-0x0000000002FD0000-0x0000000002FE6000-memory.dmp

Filesize
88KB

Download
memory/1712-362-0x0000000003010000-0x0000000003058000-memory.dmp

Filesize
288KB

Download
memory/1712-363-0x0000000003060000-0x000000000307A000-memory.dmp

Filesize
104KB

Download
memory/1800-342-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/1800-332-0x000000001C4D0000-0x000000001C518000-memory.dmp

Filesize
288KB

Download
memory/1800-327-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1800-329-0x0000000002F40000-0x0000000002F58000-memory.dmp

Filesize
96KB

Download
memory/1800-351-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1800-341-0x000000001D540000-0x000000001D558000-memory.dmp

Filesize
96KB

Download
memory/1800-333-0x000000001C520000-0x000000001C53A000-memory.dmp

Filesize
104KB

Download
memory/1800-334-0x000000001CA10000-0x000000001CA2E000-memory.dmp

Filesize
120KB

Download
memory/1800-330-0x0000000002FB0000-0x0000000002FBE000-memory.dmp

Filesize
56KB

Download
memory/1800-331-0x000000001C4B0000-0x000000001C4C6000-memory.dmp

Filesize
88KB

Download
memory/1868-21-0x0000000010000000-0x00000000101AF000-memory.dmp

Filesize
1.7MB

Download
memory/1868-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/1868-54-0x0000000010000000-0x00000000101AF000-memory.dmp

Filesize
1.7MB

Download
memory/1880-57-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1880-94-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1880-58-0x0000000140001000-0x0000000140003000-memory.dmp

Filesize
8KB

Download
memory/2000-1-0x000000000101A000-0x000000000101B000-memory.dmp

Filesize
4KB

Download
memory/2000-2-0x0000000001000000-0x00000000011D4000-memory.dmp

Filesize
1.8MB

Download
memory/2000-0-0x0000000001000000-0x00000000011D4000-memory.dmp

Filesize
1.8MB

Download
memory/2076-212-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2076-101-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2076-89-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2148-310-0x0000000000910000-0x000000000091E000-memory.dmp

Filesize
56KB

Download
memory/2148-302-0x00000000006B0000-0x00000000006BE000-memory.dmp

Filesize
56KB

Download
memory/2148-305-0x0000000000710000-0x0000000000726000-memory.dmp

Filesize
88KB

Download
memory/2148-319-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2148-304-0x0000000000840000-0x0000000000888000-memory.dmp

Filesize
288KB

Download
memory/2148-299-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2148-309-0x0000000000910000-0x000000000091E000-memory.dmp

Filesize
56KB

Download
memory/2148-303-0x0000000000700000-0x000000000070C000-memory.dmp

Filesize
48KB

Download
memory/2164-294-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/2164-295-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2164-296-0x0000000000890000-0x00000000008D8000-memory.dmp

Filesize
288KB

Download
memory/2164-297-0x00000000030E0000-0x00000000030F6000-memory.dmp

Filesize
88KB

Download
memory/2164-300-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2296-289-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2296-287-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2412-352-0x00000000008C0000-0x00000000008CC000-memory.dmp

Filesize
48KB

Download
memory/2412-354-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/2412-356-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-385-0x00000000008B0000-0x00000000008C4000-memory.dmp

Filesize
80KB

Download
memory/2504-399-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-383-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/2504-384-0x0000000000740000-0x000000000074C000-memory.dmp

Filesize
48KB

Download
memory/2504-390-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2504-389-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/2588-451-0x000000001C530000-0x000000001C546000-memory.dmp

Filesize
88KB

Download
memory/2588-459-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2588-447-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/2664-438-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2664-429-0x00000000030A0000-0x00000000030AE000-memory.dmp

Filesize
56KB

Download
memory/2664-425-0x0000000000720000-0x000000000072E000-memory.dmp

Filesize
56KB

Download
memory/2720-423-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2720-421-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/2732-401-0x0000000000960000-0x0000000000976000-memory.dmp

Filesize
88KB

Download
memory/2732-404-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2732-400-0x0000000000810000-0x000000000082A000-memory.dmp

Filesize
104KB

Download
memory/2756-35-0x0000000010000000-0x00000000101E7000-memory.dmp

Filesize
1.9MB

Download
memory/2756-63-0x0000000010000000-0x00000000101E7000-memory.dmp

Filesize
1.9MB

Download
memory/2756-38-0x0000000010000000-0x00000000101E7000-memory.dmp

Filesize
1.9MB

Download
memory/2820-49-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download
memory/2924-406-0x00000000007C0000-0x00000000007DA000-memory.dmp

Filesize
104KB

Download
memory/2924-407-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/2924-411-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/2924-412-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

Filesize
104KB

Download
memory/2924-420-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/2924-403-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download