a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a

Analysis

max time kernel
1s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
Size

1.8MB
MD5

13c75ce666d44b2bfebdd610c4f9ccdd
SHA1

1de0bca6ac975e7a52c0507502fb00e7c81630fc
SHA256

a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a
SHA512

8d44e2335b8ebb82c2bc57a4cb5b6f299522c5c413c69e6d45a2d03e982a570dc6e9f765c60c598a35cd33271ce26ae9799a841f138bb4e2b8b0d698f2133422
SSDEEP

49152:eKJ0WR7AFPyyiSruXKpk3WFDL9zxnS86KFdi2Ga9x3Ek0V:eKlBAFPydSS6W6X9ln9HFdi4VEk0V

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
480	Process not Found
2964	alg.exe
2032	aspnet_state.exe
1252	mscorsvw.exe
2704	mscorsvw.exe
2804	mscorsvw.exe
1728	mscorsvw.exe
2308	ehRecvr.exe

Loads dropped DLL 3 IoCs

pid	Process
480	Process not Found
480	Process not Found
480	Process not Found

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34a306f56fe8faa.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	mscorsvw.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_vi.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\psuser_64.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleUpdateCore.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_el.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_hr.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_te.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_ur.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\psmachine_64.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleUpdateBroker.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_en-GB.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_fa.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_zh-TW.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_zh-CN.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_da.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_et.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_it.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_lt.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_fr.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_hi.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_ms.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleUpdateSetup.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleUpdateComRegisterShell64.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\psmachine.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_fi.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_id.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_sw.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_sk.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_th.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleUpdate.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleCrashHandler.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_bg.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_es-419.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_hu.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_mr.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_ca.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_cs.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_fil.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_gu.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_no.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_kn.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_lv.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_sl.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_sr.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_ta.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleUpdateSetup.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_pt-BR.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_tr.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleCrashHandler64.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_am.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_en.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_iw.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_ja.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_ko.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT7AF.tmp	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdate.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_de.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_nl.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_pl.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_uk.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_ml.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_pt-PT.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\GoogleUpdateOnDemand.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\psuser.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM7AE.tmp\goopdateres_bn.dll	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1720	a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
Token: SeShutdownPrivilege	1728	mscorsvw.exe
Token: SeShutdownPrivilege	2804	mscorsvw.exe

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
PID:784

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 240 -NGENProcess 23c -Pipe 1cc -Comment "NGen Worker Process"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 20c -NGENProcess 1e4 -Pipe 210 -Comment "NGen Worker Process"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 250 -NGENProcess 234 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:3020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 250 -NGENProcess 20c -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 254 -Pipe 234 -Comment "NGen Worker Process"
  2⤵
  PID:888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 258 -NGENProcess 260 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:1544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 260 -NGENProcess 20c -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  PID:1020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 260 -NGENProcess 22c -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 25c -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 25c -NGENProcess 1e4 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  PID:2912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 26c -NGENProcess 278 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:1084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 26c -NGENProcess 1b0 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 274 -NGENProcess 280 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:2896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 278 -NGENProcess 284 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 1b0 -NGENProcess 288 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 280 -NGENProcess 28c -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  PID:1532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 284 -NGENProcess 290 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:1868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 284 -NGENProcess 270 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 298 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 290 -NGENProcess 29c -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:1608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 270 -NGENProcess 2a0 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 270 -NGENProcess 1b0 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 294 -NGENProcess 2a8 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:1624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 294 -NGENProcess 288 -Pipe 1b0 -Comment "NGen Worker Process"
  2⤵
  PID:488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2a4 -NGENProcess 2b0 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2a4 -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:1168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2ac -NGENProcess 2b8 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:1992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2b0 -NGENProcess 2bc -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  PID:1100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 27c -NGENProcess 2c0 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:2468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b8 -NGENProcess 2c4 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2bc -NGENProcess 2c8 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:2752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c0 -NGENProcess 2cc -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:2656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2c4 -NGENProcess 2d0 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:1244
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2d4 -NGENProcess 2cc -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c8 -NGENProcess 2cc -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:1896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2c8 -NGENProcess 2bc -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2e4 -NGENProcess 2c8 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  PID:896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2b8 -NGENProcess 2c4 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:2540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 27c -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:1884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2c4 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2cc -NGENProcess 2ac -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2d4 -NGENProcess 2f8 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2c4 -NGENProcess 2fc -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:1544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2c4 -NGENProcess 2f0 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2bc -NGENProcess 304 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:1980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2bc -NGENProcess 2c0 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 300 -NGENProcess 30c -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:2372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 304 -NGENProcess 310 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2c0 -NGENProcess 314 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2c0 -NGENProcess 2ac -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:2044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2c0 -NGENProcess 314 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 318 -NGENProcess 320 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:1256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2ac -NGENProcess 324 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2ac -NGENProcess 300 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:2112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 30c -NGENProcess 324 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 304 -NGENProcess 330 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  PID:2904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 304 -NGENProcess 32c -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 31c -NGENProcess 338 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 330 -NGENProcess 33c -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:1372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 32c -NGENProcess 340 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 338 -NGENProcess 344 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:1884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 33c -NGENProcess 348 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:2424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 33c -NGENProcess 314 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 334 -NGENProcess 350 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 348 -NGENProcess 354 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 348 -NGENProcess 330 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:2364
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 34c -NGENProcess 35c -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 354 -NGENProcess 360 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:2808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 330 -NGENProcess 364 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:1700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:1716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 1d0 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:1072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 24c -NGENProcess 258 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 240 -NGENProcess 25c -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  PID:2472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 23c -NGENProcess 1d0 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 25c -NGENProcess 1f0 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:2792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 25c -NGENProcess 1d0 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  PID:2632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 26c -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 25c -NGENProcess 268 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:1476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 25c -NGENProcess 250 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 24c -NGENProcess 268 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 280 -NGENProcess 274 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 280 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 284 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1a8 -NGENProcess 290 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:1864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1a8 -NGENProcess 28c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:2600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 25c -NGENProcess 290 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 25c -NGENProcess 1a8 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 25c -NGENProcess 270 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 268 -NGENProcess 1a8 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 268 -NGENProcess 25c -Pipe 180 -Comment "NGen Worker Process"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 294 -NGENProcess 2a4 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:1404

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2704

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1252

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2964

C:\Users\Admin\AppData\Local\Temp\a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe
"C:\Users\Admin\AppData\Local\Temp\a1c0ade7925be589d09cd3aea72a03692a336046ca8aab2a99a01a231f86bc0a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
PID:2156

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
PID:2884

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:1696

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:2744

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:2512

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
PID:2624

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
25KB

MD5
ebdf800ed360eae2faa49d25bb48e083

SHA1
6c1927392a187f0637e367805c0faa57a4a4d2b8

SHA256
04f1430de059d6f09df4debe1d05060201d8014f34997e0175390e9a52959ecc

SHA512
84fced5ac33925f42aaa1cefe9e2931b8ca972d9684ff16b2d88ecf61e8d09c6b1a65149def6ddf8085c2134bb11d06d616e734052a031becea518ee289eca6e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
12KB

MD5
707372527910bfd1e2a9ac4523a6e2f9

SHA1
d4796bb2c2f4db66acf7cfe664d3464f6a3b03e8

SHA256
765b43426f5cd4d66d26a9b4ba325fcb90fe55c127d9f4c4487737ad4e21754d

SHA512
22762288804ab08f7e39f01a80510949c679297e4aefb629646e3227f339e03eb5880a04bd0087ed13e6304ebf51c0a6fb7c7440772777ea92c732fdff99035a

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
64KB

MD5
355bdef86c40fd32191fce42406ab5ad

SHA1
e98b96f62b0d07874b5c02cef2e95e964f7e5cfe

SHA256
4ae44e3719dc27c3ac40ae7501c3785e038988b8c0271bfbe7456e98cf4d9b8c

SHA512
4ef0b7277ac2fdda49ddef9a95109ac48c4a30e770b6d5b3982fb9bad25ea41e2593b78c8a64d15149f5137f73fbffc5aab652055f68ca614867056a137f548f

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
7KB

MD5
c493c5257f80231e16422ffee65eeee1

SHA1
90bd751dc886347ddb79fb0cd1f3320830c22191

SHA256
9aa1ed61eb481eaa01995f23553b944837a5147ff69b7b4a7582d837dee8586f

SHA512
d19765bb739a0aa866b273e28fb92217fd928810f7b4dae192e7a94c18a23005fdc17b065775b669f18b3239b3ddd4ceabe31ecf69c417c24187845e12dad7a8

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
98KB

MD5
63d2d3638b33208672e186516e0a6024

SHA1
f8a2241e303b58c32851c1b24e47caee91ff0126

SHA256
19036db0a17db750d5ad02a789df190796f0452aa5aaa338d0510c96a8ef7d4a

SHA512
e2290345095c981764a892dd7dd7d3cb487d3266051b1b699a943109dfc80e1888910bbb6d7dfe45a6e1c2db28fea20c8b4097c10c5f83bec004b29aabb7319d

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
77KB

MD5
d7415679fed085c8f2220b9592b28a0f

SHA1
8c72514ece87ccdc6ff6b38f08d1d5b27373dd73

SHA256
166e7df1b2a2832015f878b3dbc170a4c197237de16f11e34a921c3bf3ffa90b

SHA512
aefbd8e2846469d9896a89d57049dc498c7955434c443453a52804247586d60da37a5a5929a7d33a01159a5892028f59ce542d195b1a171024a94e33e005af59

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
30KB

MD5
ffe3fc87a8fc0ef5c00a40119446951b

SHA1
6ad46f72982f7519d99c2370d68158367aa81436

SHA256
c9f34d5efb7935d84a9a873904fa30ab7a0dca08e0a9d6e71dce90cef30f4355

SHA512
eda1c6fc4e8f073bdfe54dff0b99f6fa985374acdb61b1ec4513d2105e3c6bd210537c4965616be3e5d1c3d3ec256578800ca0d8d70dc710fdbd83feed50fa50

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
5KB

MD5
43b1f5772df92f26bded7112c0c12105

SHA1
d6f04ef8c567f48ab5a29bf84b716297fd244363

SHA256
9d78cb27e66ea0ca66d5b9469504932b05fe21eebbdcc3919fb1b26fa98ef6d5

SHA512
d6dff32ee6cf2e572c726ecb1e7d418ac6b68779d620a36d025475271dd120f49411edfba1426d47a362ee00ae06b9f8d519666431876c253b01f2b4b38bc98a

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
15KB

MD5
e5259908a8b154ace1427224e40722cd

SHA1
0db869fd746e204a6b27221318edea2d89a3de15

SHA256
5118e6bc54d00f9c75a9786b6c0a40b665842b527635873480dc1b28bd64243e

SHA512
026dd39fdccc856416c3797411782545293576b1a34a41b25bd32ada9d3497011c9ddce55ac12dea0a36802cf6a89318ebda7b6f5daf2100c7d66b12823ec4b8

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
11KB

MD5
13b7c4d8aa99a66ea7f92cc4af3b90e7

SHA1
04238cc9350d634aaa92252412838e5b71d040a9

SHA256
1179b2472a2aef854f36660bd87310623f95e33150b613a5d8ad0832f91f5970

SHA512
d377b518fe9480bc7c5d16eb17d2643b2a57106f005901467ba263cf699f9d7630252ad82d9ec61e0c53c2c9798ef55a19bfa745d5712565e67e737281776949

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
285B

MD5
4d5603efb0c27f190d61f9c711d7664c

SHA1
94956a58a957e25ef9e4ac56a8ca31567ce71b84

SHA256
c58387f23bf4ea3c4e724737e661fc4b3a522e553a61a9714589b2eca6fbfc79

SHA512
0bd9f344b6a2ba6b5c099f88f0156da3b72923f597a111d9c5942e2c79a0732b74c171b3cf0e9ca2605ef2ec922163719986611b6a6c34866a6b24baeb138fe2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
32KB

MD5
b23bd68f2eaf8c3499ace349b12f24e0

SHA1
e706d2b276b34ab7ceb35a57b66631c1a2242fd7

SHA256
7a1828ffffdf2892cc5f9f5df1653b6eb9a2f366011fd4de17604a41d74effe0

SHA512
876505a64fe05a8132117c84774add1e31178aea10c4214a9f4181cb4410e4390cd75eadf3a2152722dc41ed76a6a8cc65fc782e062394b63c090bace677316d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
49KB

MD5
b6b0a2518bebdb26cac5aa0d034ab589

SHA1
fdbd76a961f531088c4a21c601f968320d77b307

SHA256
726d4d17a0a77d3e80cdd5c685fcd477de8f9cdcd21a0382dab4eee5d318deb3

SHA512
5a7583e7eac2cc3136052fb0b3848d7dca6f6fb5d90178bdcd65ee40c9cfd37004e795e58eaafd3ddf605d5b44434c94d05b9b9909fce3755cdadd5267da2bfc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
92KB

MD5
5f441499f02780701bfa465a2bff62c2

SHA1
9158f061d8ba792b2036bbb5c8361e665a37b4a0

SHA256
0eb0984c65fb370cc9c614658969838fb8c40d2e185197e33a1889117b0fc106

SHA512
c08caa053bf39168bba8264515deb37c87689a26db2b58f84a8bf7ce50719610581bdfa681de7b1f046f823e4a7bf701b24d321ea3c8a736e38faf8c996c865c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
30KB

MD5
322fb46f383a405bf78a7579b8e745cd

SHA1
b86227e20435422e569eaf4afc437912ea1d8652

SHA256
fcdca5a2fded876f6888b2c484001c119e1c06bb6bdd3de912eb5947ce021604

SHA512
4c81dade7ec487539212d4bfde79c8cb79f1f287d7bd51d26339f79dd3e7b9bc9d41ea67af4ee37581c8d2388f85e818456cb9678725d49923016c5accf7b3c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
5KB

MD5
544da07d3b174d3cd6a07729e81175b5

SHA1
ff8866b4d36a9d6d1694019ce33c26b4c608cac1

SHA256
5380c66b7598ce7ca9958eb9c8fbe09a45047153390f0e0baeb90828558d6e65

SHA512
d669904f4d2e945becd0d5bc7eed5c43463dee524fc5c431b3db333e82b5cef1d3b1755d007781a11d2f62232ca4436db4ca70444a2ce891ed60672ca9c4728b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
2d4510b1c2733c6a6fd1fb129f54c9e5

SHA1
ecf813817737fef3bbcb8363cd02b2116a004087

SHA256
92087bdc0a431aaeec43137be805a25fd8aaec6b60eb40d8f0bb62967197f98e

SHA512
319cedb2044d67d83de86014c1eca29f876f08b03e2996535585d0904577b59e470adecdf9c313a10972e17dfe73aa3bae9cc673d926f087461ffc721b67b038

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
92KB

MD5
b4c32db58aaffc74cc92692507c99e43

SHA1
fe9fbe720d6d370d8add55893634660b09209fe4

SHA256
fe10f77c5aca789760685f4fffc8d1051cc10dec28f9bea0a2468ab03269c83c

SHA512
e9730d29861e8e04d62b273830088b9b826c03e330452698fa2a5fb234a54825a752b0f17443102b5dbc960d0378466d95e44087870f1146ecbb3fa0003714fb

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
92KB

MD5
f906dcac451f4bbdd553a6df9af0219c

SHA1
d71730d9692fd7c32c687a093b63e3986639d3da

SHA256
e59275d23208c2cf58e9bb6fa7c7f023d0cd92bda74f68afce991f47aa039be9

SHA512
bf5f60fa44233b8636905a4b744998c7ab46f3000ab2a6a18dcc99a5826db86e1f9599990ea1e0f7acf38ddcc13e69eefc81ad159cabf735f1c5ac05fb825c27

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1KB

MD5
f18179eb20f38fc4e2769630beb92b80

SHA1
7dc9dc541d830737aa8a7502aad52cddfb8c4dcf

SHA256
b0fddcc96e89a3eca4a1655fcc91790925ecc5f435d1ff1808a9d1f411ec41c0

SHA512
6d89c1ec8c10c392a5c7d35f89435e87cc7eb102dd2b1cf7d410ea5b65267fde718a1b21413b6db4721fa471c8c922c95652d1eab0f11ee88ead1e4989803b60

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
12KB

MD5
10b2eef845aac4803f9eba19a1d5b421

SHA1
87cb819ce8c3b8926ba380c23e87e44be19a3195

SHA256
6220556179d8113548e3dda7ae2f825089d303761e716b7e13ddd24694c19a85

SHA512
70f50185dded63319bfd063ea65497d5e0b46676327e792b9c04cc6f6e5cc03416031d40040038032d060290dd1792ba7eff399a1c5177f7b64f3ab6ab202058

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
83KB

MD5
3f40c73104cb2af09301dadb91a0a92c

SHA1
0060fa21b934a6e7ca9f3710deb05a2b81d5c30f

SHA256
b5d3e95157a1c8e0f43570384e20640851eb7dd3845a62948370eb21fc8c1b59

SHA512
803bcc57523778c01648fbf9a716da7a5eecf141fd1ba5a2ae0a73eb3b0556247ae3b4f0e3c1df5718ccfade26fa2e9c96ea82db4c7beb0c53227d438a07072d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
179KB

MD5
27c7259e0a87fcd1c83e51e353286661

SHA1
336fe8fff75d8228ccb4f269a8e550395999f680

SHA256
e37d5c29155f3066cfa9bf886185ea878e0dc123402056b24aa0c71d98c75fbd

SHA512
d9e0feb6ea3fa0a0ed4c870c086c643fc12a9e204874f31dc04d950859b8ba00adf208f663df84bdd682a41a330f31644d2d46f032ed2359e2287ba7b49e6379

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
240KB

MD5
76900e746a5a19ee940173a26d39cdc4

SHA1
6850a757487ca975485945003dd64f223484a544

SHA256
528733e4ca80c3a8f4e8e686fc77bac134183b88e475941bdcc90648b6714668

SHA512
161b3e30f84d9511a46040e851fd3920a8c86f2dd843e1cbc688c4fd3bbd703847ce2ca48c3279f557c4e455f87e004a2c374b960619abfc51864e496cb5dfcc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
109KB

MD5
afff3abe1221a4448d78ff6865b1350c

SHA1
69bb623e27caeee99d0ac40f9ff650c4a4c96354

SHA256
f749a0174e6a7944cc4d3b52d78e237b24f7851a4c9a5e60198a9985930786fe

SHA512
7df97d0eb8c3ee2292675b25780bd4066598cc2d91d2b42dfb448937b8dc430b6d219939868f23758cf457f3cdf31127444afd3ce5e9b598329911761904287d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
49KB

MD5
6caf145776b2faa4ef473d3b3f29913e

SHA1
04e98262eeadf609a6e3e1a016d413efb028cb34

SHA256
106f0de4f48f38c7c2747aff46c2ebf21f700b6fd595e4a9ca87aee55e82c219

SHA512
ce862bb7569dce617f591fde1c9fa518f5c53266e5ece34c171f2f60a27110e88d91b5ae97b01d01496f0bec785f58fca7344a52d1eb20d0eafde2b15f816fb0

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
301KB

MD5
7165a8ca89824d555faa88ea0cc5cd8d

SHA1
730ae2c37d8374f3b5d7a9dfed08eea5446d036a

SHA256
c7c241fb1af11f3952044527f6e40ba44673bf7248b4e0b589e7d03fb9bdb0ef

SHA512
919e7f9398a0b2186eedc1beed25cd4150465a66b40526c3ea94234bae10e9144ba8b5e2951c560ccfc56e6306563e6f20212f6e95754d83297d1f5e534b6393

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
90KB

MD5
b3c9ea2f2c53fb404ba426313927c375

SHA1
21b6a6648ef7a1eeed7d2180422baffa0b9d6608

SHA256
a4ea2bd7295fc5eccea6f3095c05c7ed1dac6d548d1a3d43b11342641a0da8ba

SHA512
4109ea06d30e24c4c17fc88d3611e0f3f4c09b8c7a65a38e3e665eae3219937bd9a19bbed1506dbf9207b5e169f098eb497f1f9d9ce882b87a53080c3d5b99c4

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
136KB

MD5
602a764add491f76b8589d971c2ea88e

SHA1
4549c135bad5f53d9185a8edd8a6893523f2fe15

SHA256
3ae216ca0a0ff910074c89b1a9a9ae0a3ad9e32cae84653be69f59a2285ddab0

SHA512
71687a49ababb3594a7d9912a19ca3985c4723754a2ed12f500b02dcaddd3b22ff5c6a7909009ab1b26ac4b2bf8feb0deded27b61ddf10c151f90e0802c46660

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
29KB

MD5
b1e457374748a0cc5306af992b54b46d

SHA1
acb8bfd39bf558c533581d5552bf3fd26289d482

SHA256
b4d498375a9d55dd4b5d18734f25d684bc620f572b8c12b3824e0511a68adb6b

SHA512
52aeadb30240a604804e287792c652a4024cbe5a19584e85b77668059183eda59b4c44d04fb77f7b58e91bbb844439b7df5eb20390b495ccab343b2eb8012019

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
73KB

MD5
bf3ed33ed13c427dc7931b6147695e00

SHA1
a2b9dea6310074ef6fa64d7c9b0388493d0dae2d

SHA256
5d038b621666dc8c641f32f16bd626915f5b1f8300f1e79fd07360689c029404

SHA512
c2ea9c8b1f63f89df4dcbf837ec63d5c487f65c4dfe31e6d3675980304a05db919ad7b0afa89ca35f78b5d6835faeef2fa156e45aae6a2b1d9d6ee23ae8107e2

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
48KB

MD5
194bf9e2ee2c25845c276514510ed98c

SHA1
53f09ab17c8fd85a451d730ee4a194253b95565e

SHA256
b208cf1dc639bd4bc247fcd3d9cc8aa5d491b60cc99eb9634193fb4de73de907

SHA512
03ec6773caba0256604093d1e8126165bcdb4c371379de405f2086771d51e4d05ed4a70ba573b427e045c903cc48afd5053dae4ea575396fae555f4b5fbe9fb2

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
49KB

MD5
9cf1ec1a9632fc15eb20646b6034ed73

SHA1
08524c809d9fb994870e90ed9a5f7efbd07879a4

SHA256
48d984a068c1a525c7d371084e732d94ffa25a0a57e6a37be13745bea70bad9a

SHA512
511c5ef6265cfcb716de113bc7bea3818c64316ed248f4fec6821273051b031c7705cac82b07c7c9870012a14880116d495b7be912cc16be7696ff9b1142addc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
63KB

MD5
f1edf59189838b57929348bb1ede0e73

SHA1
09306e231bf1236fec2560336a360278c29e3ab1

SHA256
640a46d3912d3e9296f8ea415e3fe1fd601d7142f7063033c7bf46ded559a2de

SHA512
94db6f8791d87a9ca69f751643f7fcb770d512be0f2d88358d85fddf347c115081e4f011a6a40c8215bfdfd6b0bc9994cac89ade35113e8c99f59f4ff4bb8717

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
143KB

MD5
a4edafe40d9bb8602ed54e715afd559b

SHA1
609a8b48c7ca5f3656666638ce4dc5c3d76ce68a

SHA256
08e24a28bb931438ec4638bc2ac567d42daecd60edfb77e3a3d194e5f66a583c

SHA512
badd4f2d9f610930dd5bd11d193d681759552016d44be1d4d44280f813eaf125fa7680b4d776d8ed4ada85c921d9eed844432da07fc1d4b33931551b4dcbdd71

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
357KB

MD5
7d7f111c3e6b5abdcea2caa0b38d9ff4

SHA1
f5c2bd51d72a40f883bc6d58a49c03294654bd00

SHA256
c636696118b6ff8cec8f36f3beda650d2739b4c48c0b1c57a2d035f87b986a57

SHA512
2747f819a15a5813b84bf9e922eb4d50fcbdc92e0c627b36f8c5417611b85329a942c89d100abb56d802528b4491e7b60b7c8271abd1e0198120782ff39b4e35

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
44KB

MD5
d716865a2125bafceb6627d513a26106

SHA1
39898e5461f1200f481b8c69f867b3541ca2675d

SHA256
803adb8f5b2f929a78ca7d472f4f2c911f194aaa59b75a6cafe2d0589283595b

SHA512
e69da3af4989a96f0c7b18bb20e8f4adcddf110f0c216e9e30550fd049677c18239478a3f0eb0d22720f0b9ef77beb505d49fef72e2a253515b085d31aa9354f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
85KB

MD5
ee15c0073cd706ed16bb335271d57003

SHA1
3a9d0f40bb28ab3e5b557af86509e548a6e22de7

SHA256
738149125e667a43006c712a64ae6c4e926933569ff3121906018ec7b5d6602f

SHA512
e878c2ca1d9797f3d7320781ac532c4c1122687407f4e230a03e84ead2046591115a80bfb7f94a74477836a629a0a6c83811e8b26aa4651f99a3168f9e4ef100

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
93KB

MD5
6f6c5fc3368c77d634b8c38f3b76582e

SHA1
d60d2a4d0de6b4301b83f0528ef88160744a1109

SHA256
bea6815acaa3a17ed624252d6a6d00b7e7178304871a77ec2a380bcd6d69a179

SHA512
470e34d62ba8c40766c11053911398c71ebabbc2aec150d0bd1dba1e211cc15e39be56e1608fff343c9844b4958835a53ac8351e0d9409fbd905ae2b58df8c0e

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
18KB

MD5
7123a46b599f7643f147dd69b11a77f4

SHA1
8616dbf18103bbf3be023fb78c0fcd3db25b82c3

SHA256
e21d7e573bdd6378aa17ca18a7b53d089300c4fa140eaaba721922386b55721f

SHA512
69cb81a978ae64e04e066af476278bed19cfd717d21fc19f0869358473bf294b9fa0b9a30b7b8d1bb1a65a4dab3c23de8ecd1624720c6ae26d94192feb8d3a41

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
32KB

MD5
f4911108315770c60cc2650057bf1e05

SHA1
670a8b60662d86d88c10cd8d94d951854db399a1

SHA256
b53b9798add7dc7d54552a814aba9da33edc0c85230775731ff8c0c29548891f

SHA512
3fd834a4107a89f582ec3afea12355cb4898487410a0802530c915cceeee3179198f58fcf75583bd1c50d07e09083da91cde399d8d3de783c7a3d20b5fea01d9

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
96KB

MD5
a9dc37fcca6134ddf8b8ebc751cbf843

SHA1
35aa5649cf179ba5ab71b92dd94ec12bb85a9bbb

SHA256
b9e6981dc503ad885c8cbb43f3ba4796ad769c43dc9fff26e4dd2bf0082e6452

SHA512
1163b823deda022bc3487eb681e7b840253ff97ba9accb1f9442d7ec2585d7944906753e08bb9c464ce89af52fa3d66273ad5383d07b5d778d5a9099201c672e

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
57KB

MD5
5f45350a7c6f5cb85532aee7066196ea

SHA1
5e9fcd88421a0860bc1b0b20b9b6d4954bd5cb60

SHA256
ecb5595819c14b8e6f7188c8b01e968dbbe309002e4c26d0db079a388d33d07d

SHA512
508e5de2270f067ab864624f13e5dd9fc1eadcda26b2753d65488d28439ea1178b58714b3320a191540762494d12c68da196e3000dccb7583d5c9f5a8c54999e

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.2MB

MD5
090780240c7331987cdac08b76058b32

SHA1
9c92ad45529ce2ecf1918d1d3d21dace3238a3cf

SHA256
6aa4be8e6c0fbf06a875840168ca299f054d198d452c248385d9e84bd7232302

SHA512
20018b515f55e99b4d8f4f866755125508dc84a1ec5cd2a185565693b114eb8593786d42b40e0fe888df0af3bc5c9d2581508ef555fa4185eabfa2859bc9dd1d

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
124KB

MD5
9bfc7ea7ae19f08d63e9dc1b4fc7ddd2

SHA1
cd74789b3398c380289f3630134dd8e1dd03bd78

SHA256
96c9e380fd0261725ccc906d0b03aca79d0774475a3c4589a861f200bae13174

SHA512
76107d955d21a569199087bb271c98de40f75d2f7c1e0a54dceca02fe7e8ce74225f486903283366bdf979b74679fd86567f0e04e92c8fcf2d34c1ef61e01e5c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
32KB

MD5
28e4138342f880dc394754a5cbfbb33e

SHA1
450c8814d6814ff3a77c4e17eedad28413959b85

SHA256
1b91f790f549936b31caf85e1b9f6ecb7ba0a962f2604b3a3675c3b5305032f4

SHA512
ab4cda0683f1fd134c5ce162bcc75288ac718cbea03263b60af376dd357351771e3af597e597f300c2db5c3091496ebfbe248406b46f285cbdb6c1a571e3963e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
117KB

MD5
43942ab560900211ad067be7543a5a91

SHA1
d008e8d287f26d736a33692952c898b8a6153074

SHA256
200cc0ff1e8281a6f8224b85572b7f3f3346e7eb08d3498f30ef770a9cf32a07

SHA512
797fa72aed41a65ca66a548540a23f45f8d04002145a525579b3c87f658710b083a62ded5eaba0c8298a59ec66207cb50f991f74142cd7cdc0385679e1ab4602

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\3013b0ef5def2e0f8dd9428870345a36\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
578a8574ad5b72a052c264dac500aadb

SHA1
ad34d5ae1721a9f88bf3ab3a0a74127175f6af7e

SHA256
34089c063dc94b13e71113703d1f8a8d8956e874674f243992c49655648a248d

SHA512
8293c37ef901a9ff2944bef349fd4b55ff6fcbc5e8e747b606a4adc60e8e3b43a093c6a78f8c6224d9d7f3a93d55a295ecb0e6bddef0fdfe4e8aadcea0fd422e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\51ec25d1f60f68ce16ac8057010714b5\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
299KB

MD5
9a3ade6e1d35fc98d75984ea7a5655c5

SHA1
72aaeb6b2739a413f53bbd0b9b24590a99db75aa

SHA256
d68f5800c8a41bbcc90369610bd600dfcea5ab25d0cba30ff2de18af4420b7b7

SHA512
398241e9e1b79d6d0f51f1f343f77a550118af4d7014ce2a71aa37f4772b3693a7abce8a9dd2551ee73742c7290d1c32beb1520e75907ddad955cf4f4901e4af

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\991079bfa4b428fcd8efd248efd0f6d7\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
64KB

MD5
93c816926130fbc23f2e5cf295626b2e

SHA1
8b037417c2e6a9f728fa483e7c079ed3a2a14ed0

SHA256
9e066ba4ec3538c27f7e3d566998cb431fd6aee2886c6c2525c7f00c196ce89a

SHA512
29700623cf38fba4b0c0fe0245f2bc33ddc6f75327d3beeb8ae0d5aa1e8dcd5455dc824461af3e09282d0aa386a2318b905a417c3c2ca3913f058407ad7ebcfb

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d650106e6f92c63f6bfd4b0a8fead22e\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
e85ecfaf7b58c6d534de8e256949cbd8

SHA1
22bc776e1265e67a5ebda6ec0ba08044dd290675

SHA256
fdf0991d7b95b001c18d1484996f9e1b087a8a89c86f455dd7dad6eb73a2ea51

SHA512
ad707798b019846ece0817ffa30376fc6c24b108231a04b29f0f9ceaf679756baf78e7c9b0ae5ac5dd752839f9cebcc76fd2b1e32756d512360b4672def99bb4

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
3KB

MD5
8133f24391e714eb2355a180c0411636

SHA1
16b8bcc3972f38f15b05e878e84fbe1ed9633a62

SHA256
56932ef33fdeb2f22c291151c64c1bc7f4e24f15c7643db38c06e47de4b518cb

SHA512
48619adfed73360016ec1cc20864c4a611d09774541e44bf44a02db5a40cd5dd966ef93016b25103c27f75a995dce35fab5db67691e24282fd5a508874f637e3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
267KB

MD5
50265b39311547c6ebf6dadeb763b806

SHA1
1cdaab4578dcb328103dfcbca027e3c0db56f99a

SHA256
82fe95105e939b5f7ea60af40378f9f5498e6c68628b40a310893d7449599f80

SHA512
9542a40ba0d4e71f5c8e1bab5dd41a73dd8b63dbdd09baea82083bde9c7c024baf316d45eb1c46712fe8602081111fdbd0e55fe41de2781c8715b9c0faccab6b

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
C:\Windows\ehome\ehRecvr.exe

Filesize
49KB

MD5
da52d99d7b15c8c0176ffb35f005e868

SHA1
efeb0cf40b6f81134239e51071ccc44630f4402e

SHA256
3461a33eaea3205ff6135ecd914fc7b00e6d86eb48c4585856a38ec5d4f1b86d

SHA512
d8c72a5155091976e04862fb3782a573b2d51e9ba586bba0dc22d761270e91fdab015f6914ef403b64db830c68a1f6368b52bd47b33a1ba220359fe25659019a

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
27KB

MD5
adbfbeb79ef5b72c34f06c06693c4c8c

SHA1
1d59d7c32c157382d9c1fae3dda46de94a9d116a

SHA256
b2621413b609ce06d88bca8c21bb3d12988cc7deb4ffeb0e561f6c79a39dfecc

SHA512
89ba0b9988113447b8c92967cce09cfd6d92b69ff4c84afa093a1ba620f9ffc3b0d2469f578ebabd57322919d0fc9364fd63a3bb478579b892b0226c37858ef4

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
3KB

MD5
9c54585c4564f387143ec27c0212039e

SHA1
6f33aac42f14e224f53b2af52d8be6d142938b97

SHA256
345c7f7e063ebc1b86503bc11a814739488d0d248b4f59d8e037f5cfaf330d60

SHA512
387276d192c7a1832f4aa0431a9b592ba717cb4ff560ec97491d55c15f20043f0fecb46c9f52503539a29eda57f9e336fb07cc7d9e4983ea5297f503b022c754

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
134KB

MD5
0d7f27053c5638490b57e512337fda8a

SHA1
46d9f08dd8ad4cc8184186d359b996d755694eb5

SHA256
b502dedfba6afef645a4b45a5e58cf839bebab53e389b814a51c0fcd920841f9

SHA512
4a911bd8ec6435a5ae951f9b12fbcec9aeae0b7c2a6a3178b6bffd01a8c3ae8c97eff30fb14f7119b1bb3cd0ab67a84e5e7d44efcad1b51c8faa0e1908462cbe

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
106KB

MD5
02631e8c09f08d18a3352e2618a097aa

SHA1
d16136010331bf0f9790c8e61ea76e9abab946ff

SHA256
de09bc7e368dfaa207f902d6d47bb6d5658328cb6e756fcfd593c005d651e1f5

SHA512
f8e7a26528f1e639ff4fb62df0c79dfc4c6fdb4911fbc27c27e1a3a03b59d36871c3f8222ced5ff8306183956534349aeb001efdc9ee15a7c42536062190957e

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
128KB

MD5
1ee8cd84de1492ddf791fd9779fa4475

SHA1
d7fffffe10bde344984ae09c0f27fbc80deb9692

SHA256
586f49a930be0dbac9f9a83d18729b3d2eaf621ca2d1e154054d8059dd5883e6

SHA512
b1c0902b2b4896ed70eadefb310fa8ce33c571818db10a06eecf81a9efd5ee083b49a79558c20bb17550ebc64bd50c75bd5783a59edb52065f04a85a57bb4914

Download Submit
\Windows\System32\dllhost.exe

Filesize
77KB

MD5
501da3fabb348eb9f351c224e75ec64e

SHA1
1eaf870e1fb83e57ddfeb5ad7901f4141bd1fefe

SHA256
8ac9dfd7c4e7635c2a457280a4cbf884f169340c7deb002cc0c05acf53aad599

SHA512
889e6a9cb96f85dc9229e04a5fbe53654311502343766ce6480465ed43a82f03c4d049841a2a5671c1e74d777fc9f8b9870066ac7913e11a7097894a59c9b6ce

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
6KB

MD5
f049284dfc67efc8d886a8263452724e

SHA1
ee39ba3b52c147bb1fcbbb9e137249c6a2a0d0be

SHA256
e43b91049adab5867869ca17184c34c121d17ec9d55551a14918f5bfd9150c91

SHA512
15434024c5afa3a69938114651d6c6cce9c892a57fe7cada2af2177cbd896b75092cf0cf2e3af9f73c7550bbd7466c3fd81c4da964ea9871e299c618605777b7

Download Submit
\Windows\ehome\ehsched.exe

Filesize
8KB

MD5
94871f8f1d5dbc896db30a2a1aedd5d4

SHA1
b0e6c87fd5c5b8d710c983a83529559cdc139d2c

SHA256
5ae73e9b42af4479f34dbce809341e726c0a24b53a4adb384b28e9835314107e

SHA512
a61421a5118037688b9ac87d75af8ca62b5de0dbf4aac9a9288b4eea3fa98218cde4ee91cc4cf0b3c0ddcdb3f7f98fa2870748595547071ce559d5e544ec78ae

Download Submit
memory/684-427-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/684-490-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/684-450-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/684-483-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/684-454-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/684-484-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/784-173-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/784-321-0x0000000140000000-0x00000001401F1000-memory.dmp

Filesize
1.9MB

Download
memory/784-175-0x0000000140000000-0x00000001401F1000-memory.dmp

Filesize
1.9MB

Download
memory/784-256-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/784-255-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/1252-99-0x00000000009A0000-0x0000000000A07000-memory.dmp

Filesize
412KB

Download
memory/1252-137-0x0000000010000000-0x00000000101DE000-memory.dmp

Filesize
1.9MB

Download
memory/1252-98-0x0000000010000000-0x00000000101DE000-memory.dmp

Filesize
1.9MB

Download
memory/1252-104-0x00000000009A0000-0x0000000000A07000-memory.dmp

Filesize
412KB

Download
memory/1696-299-0x0000000000FA0000-0x0000000001000000-memory.dmp

Filesize
384KB

Download
memory/1696-287-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/1696-298-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/1720-0-0x0000000001E50000-0x0000000001EB7000-memory.dmp

Filesize
412KB

Download
memory/1720-250-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/1720-7-0x0000000001E50000-0x0000000001EB7000-memory.dmp

Filesize
412KB

Download
memory/1720-141-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/1720-1-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/1728-147-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1728-146-0x00000000001F0000-0x0000000000250000-memory.dmp

Filesize
384KB

Download
memory/1728-139-0x00000000001F0000-0x0000000000250000-memory.dmp

Filesize
384KB

Download
memory/1728-273-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2032-95-0x0000000140000000-0x00000001401DC000-memory.dmp

Filesize
1.9MB

Download
memory/2032-172-0x0000000140000000-0x00000001401DC000-memory.dmp

Filesize
1.9MB

Download
memory/2308-309-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2308-160-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2308-174-0x0000000001990000-0x00000000019A0000-memory.dmp

Filesize
64KB

Download
memory/2308-166-0x0000000000180000-0x00000000001E0000-memory.dmp

Filesize
384KB

Download
memory/2308-257-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/2308-171-0x0000000001980000-0x0000000001990000-memory.dmp

Filesize
64KB

Download
memory/2308-340-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/2308-159-0x0000000000180000-0x00000000001E0000-memory.dmp

Filesize
384KB

Download
memory/2512-392-0x0000000074728000-0x000000007473D000-memory.dmp

Filesize
84KB

Download
memory/2512-344-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2512-326-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2512-552-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2512-555-0x0000000074728000-0x000000007473D000-memory.dmp

Filesize
84KB

Download
memory/2512-341-0x0000000000160000-0x00000000001C0000-memory.dmp

Filesize
384KB

Download
memory/2512-508-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2624-445-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp

Filesize
9.6MB

Download
memory/2624-307-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp

Filesize
9.6MB

Download
memory/2624-447-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/2624-396-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/2624-305-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/2624-303-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp

Filesize
9.6MB

Download
memory/2624-541-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/2624-554-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp

Filesize
9.6MB

Download
memory/2688-330-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2688-355-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2688-449-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2688-339-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/2688-443-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2688-448-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/2704-116-0x0000000010000000-0x00000000101E6000-memory.dmp

Filesize
1.9MB

Download
memory/2744-311-0x000000002E000000-0x000000002E1F4000-memory.dmp

Filesize
2.0MB

Download
memory/2744-313-0x0000000000390000-0x00000000003F7000-memory.dmp

Filesize
412KB

Download
memory/2744-451-0x000000002E000000-0x000000002E1F4000-memory.dmp

Filesize
2.0MB

Download
memory/2752-512-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2752-525-0x0000000000720000-0x0000000000787000-memory.dmp

Filesize
412KB

Download
memory/2804-127-0x00000000002A0000-0x0000000000307000-memory.dmp

Filesize
412KB

Download
memory/2804-121-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2804-269-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2804-122-0x00000000002A0000-0x0000000000307000-memory.dmp

Filesize
412KB

Download
memory/2884-280-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2884-387-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2884-282-0x0000000000520000-0x0000000000587000-memory.dmp

Filesize
412KB

Download
memory/2920-267-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2920-270-0x00000000005A0000-0x0000000000600000-memory.dmp

Filesize
384KB

Download
memory/2920-260-0x00000000005A0000-0x0000000000600000-memory.dmp

Filesize
384KB

Download
memory/2920-336-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2964-158-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2964-42-0x0000000000900000-0x0000000000960000-memory.dmp

Filesize
384KB

Download
memory/2964-18-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2964-13-0x0000000000900000-0x0000000000960000-memory.dmp

Filesize
384KB

Download