31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9

Analysis

max time kernel
15s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
Size

1.8MB
MD5

e337ec0176ff35dd19af706ebeb970a7
SHA1

04df2b0d9ca893bd4ff0d9ec3825370644425d8f
SHA256

31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9
SHA512

fc8c627662cd80e451f273b3cb6a2e328f45d005f308253f594089b23aad266aeb6db668df8e7e1eaa848adad2434d61c00e00f6ebd66eccbc3cad4e2ef85714
SSDEEP

49152:DM9QPdxwfE7WlFwKAfzuTiDFUFk7xlMPdlR8v4UC0Eg6ET7M/I:D1PdVQFwKZCFgil2/V0cETQ/I

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
464	Process not Found
2780	alg.exe
3004	aspnet_state.exe
1692	mscorsvw.exe
2208	mscorsvw.exe
556	elevation_service.exe
2408	GROOVE.EXE
1784	maintenanceservice.exe
896	OSE.EXE
1096	OSPPSVC.EXE

Loads dropped DLL 1 IoCs

pid	Process
464	Process not Found

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7bf7ac44c0d5d3a4.bin	alg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_pt-BR.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_pt-PT.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleUpdateBroker.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\psmachine_64.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleUpdateCore.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_am.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_ar.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_de.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_el.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_sl.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_sv.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT54F4.tmp	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_cs.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_id.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_tr.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_hr.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_ur.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleUpdateComRegisterShell64.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\psuser.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_en.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_et.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_gu.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdate.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_sw.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_te.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_zh-CN.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_iw.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_uk.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_is.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_lt.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_sr.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_zh-TW.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleCrashHandler64.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_nl.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_pl.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleUpdateSetup.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_ta.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_th.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleUpdate.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleCrashHandler.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\psuser_64.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_bn.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_hu.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\psmachine.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_bg.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_fi.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_fr.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_kn.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleUpdateSetup.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\GoogleUpdateOnDemand.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_fil.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_hi.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_lv.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_ml.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_ca.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_da.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_it.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_ja.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM54F3.tmp\goopdateres_ru.dll	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2512	31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
Token: SeShutdownPrivilege	1692	mscorsvw.exe
Token: SeShutdownPrivilege	2208	mscorsvw.exe
Token: SeShutdownPrivilege	1692	mscorsvw.exe
Token: SeShutdownPrivilege	2208	mscorsvw.exe

C:\Users\Admin\AppData\Local\Temp\31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe
"C:\Users\Admin\AppData\Local\Temp\31b0bb01f61921fdb3c3cf8a08958f395fa13d54ef743dce12ab89ba77a45cd9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2780

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 244 -NGENProcess 1f0 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1e8 -NGENProcess 24c -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:2180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 260 -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:1708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 254 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1e8 -NGENProcess 26c -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:2200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 248 -NGENProcess 254 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 274 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 278 -NGENProcess 254 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  PID:2608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 270 -NGENProcess 27c -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 26c -NGENProcess 280 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  PID:1988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 284 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:1044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 274 -NGENProcess 280 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:1284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 288 -NGENProcess 26c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 284 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:2348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 274 -NGENProcess 294 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:1416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 284 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:2452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 298 -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:1000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 274 -NGENProcess 2a0 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 254 -NGENProcess 26c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:2816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 2a4 -NGENProcess 298 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:2720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2a8 -NGENProcess 2a0 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:1288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 214 -NGENProcess 2a8 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:1552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 2d0 -NGENProcess 2a0 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:2880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 214 -NGENProcess 2dc -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:2464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 2a8 -NGENProcess 2c0 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:1288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c0 -NGENProcess 2c8 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:2180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2dc -NGENProcess 2ec -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:1884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a8 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:2064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2f4 -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2a0 -NGENProcess 2f8 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2fc -NGENProcess 2ec -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:1380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2ac -NGENProcess 2a8 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2c0 -NGENProcess 2d8 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:2976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2c4 -NGENProcess 2d8 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2ec -NGENProcess 30c -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:1360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 30c -NGENProcess 308 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:2472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2c4 -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:2164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 314 -NGENProcess 320 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2c0 -NGENProcess 324 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2ec -NGENProcess 328 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:2312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 328 -NGENProcess 320 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 32c -NGENProcess 330 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:1764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 300 -NGENProcess 334 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 320 -NGENProcess 338 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 330 -NGENProcess 33c -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 334 -NGENProcess 340 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:1112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 338 -NGENProcess 344 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:2532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 2fc -NGENProcess 33c -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 308 -NGENProcess 33c -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:1420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 328 -NGENProcess 34c -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 34c -NGENProcess 300 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 308 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 330 -NGENProcess 308 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 348 -NGENProcess 358 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 344 -NGENProcess 360 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:1112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 350 -NGENProcess 364 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 368 -NGENProcess 360 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2fc -NGENProcess 36c -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:1520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 370 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 370 -NGENProcess 360 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 344 -NGENProcess 360 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 330 -NGENProcess 378 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 208 -NGENProcess 364 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:1152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 360 -NGENProcess 37c -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 370 -NGENProcess 368 -Pipe 208 -Comment "NGen Worker Process"
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 330 -NGENProcess 37c -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 348 -NGENProcess 388 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 360 -NGENProcess 38c -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 37c -NGENProcess 390 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:1936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 394 -NGENProcess 38c -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:1572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 348 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:1020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 390 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3a4 -NGENProcess 39c -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 398 -NGENProcess 344 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 348 -NGENProcess 39c -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:1364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 388 -NGENProcess 3ac -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 330 -NGENProcess 39c -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3a8 -NGENProcess 3b4 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 348 -NGENProcess 3b8 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:2452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 39c -NGENProcess 3bc -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 3b4 -NGENProcess 3c0 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b4 -NGENProcess 344 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3c8 -NGENProcess 3c0 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:1496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 3cc -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 39c -NGENProcess 3d0 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 3c0 -NGENProcess 3d4 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 3cc -NGENProcess 3d8 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3cc -NGENProcess 3c4 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:1364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3e0 -NGENProcess 3d8 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 3c0 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:2284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3cc -NGENProcess 3a4 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3c4 -NGENProcess 344 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:2588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3d4 -NGENProcess 3a4 -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3dc -NGENProcess 3f4 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3d8 -NGENProcess 3f8 -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3a4 -NGENProcess 3fc -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:1948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3f4 -NGENProcess 404 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 3f8 -NGENProcess 408 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3fc -NGENProcess 40c -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 404 -NGENProcess 410 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:1472

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:1796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  PID:2472

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:556

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1784

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:896

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
67KB

MD5
69b9e053360181db104bfbdbca80c5dd

SHA1
d95e26d5c3c7b5efb1c9494e8e1dd4c05225a35e

SHA256
4ae43b5d8584d0500a73f0094a089882d658c19ba3f0e71f2765632ce2da5d89

SHA512
e0e3fdffbfd4969e5805f56f1c3f9d3c018afd24cb368d59d49e7466355e8e48828c400b658a98e4682e9072b966dbf50fc9132055a0a00a9a2d34c57bdd0bc3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
188KB

MD5
309e7fb30488e4847dbc43d7d8ea775c

SHA1
d347b5c0d4e03ebf7b1ddd2f407dd81ae8e4c317

SHA256
69824e93ca267538a05ce331d0d308e1515c46234840e8a8e54a0efe4c3b7c78

SHA512
dd0161d036307eea3d1e1cc68adf7c1e9beb6f72ef11b6ecc117e249f26eda08c43a6b916ba242262ec9deaede688838c087c17d6f07e357b0e060b14ffd6da9

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
141KB

MD5
c6b3f96b36aef21b98599eae2a7fe7ef

SHA1
6a221f90c994510a9184c8940fabea0f6f4647e8

SHA256
3269219d2fd55c65086a2e22c1cb978e9f2590178cee695dec1155af515997b5

SHA512
04ac939fd3d397471d45fbd64495cebaaab237f2fbfcda161e23cc05847affa76279a8da5665673ec26dc421476b72e9cf21bfa33f0906df8af027ac403d5f03

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
136KB

MD5
7147df6690ce673c9c6e1937efc0b2a0

SHA1
70429e7be0daebe345bb7fcfedbf2802067c4bad

SHA256
18657b80a6b91146a1d882d1aa3da7b32d999a2b21a978fe8e3eaaece84b1537

SHA512
db7779c56f29723979e172eb3d7166afc2ee02bd35879408d73f62d4250be90be432a0831a82c1cef55894e68b38d459eabd572f5f0e97c9d5ae83c9cd582deb

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
174KB

MD5
3400d7d527a7652ab5d7a097b3459d57

SHA1
aa57e7ba544a41b689b8ec47ff3432c4e8e69568

SHA256
5b0d3570d55fc65f30695df2fb0d16f765088493a2390c679793582004a0625a

SHA512
7567dd90d6a44cf34b69c9040343ad59937fb539f8ebde8be51d6c99c853b38d74d2031044664c5bedd996fedfc7870a73df616ea49304bbd21aef21c8ed2cd9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
602KB

MD5
471f95ab3e3b7c37a629a0de4b56469e

SHA1
dc76412a7ec4fa3b3526602d1bcd761494178284

SHA256
1567fb409b9a1a95e0c5e1d70833bd708497559aaf0d7502aa141aff358e1473

SHA512
1b2a230f21314f0a1f0671178647ae0e5afb5964fb146e27af294320a3cce1c27842ddae89dc9a7fc529a265bb10012b4d6d91363ba3a465d2e6c34e184a6db7

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
108KB

MD5
d369ab13d6c46f7dbb7f61fe3369e290

SHA1
2a17c8f1d7c452251dd01d8de7c1a206f9352637

SHA256
651b0eab92b9ab59cb7eeacca4fa56cc51d3cccf5f4f75d5ec3080f46a00ba7f

SHA512
986a69df0dce509d1e02f4d2f0f37dd11006bcd7bfab79d1d718e057e7ad186d76fc0f82f181066081da27006f1a35854cd50dd57b4c0f90040bc1debb091bf9

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
53KB

MD5
824074c1090c462ec91b12f2f42fa518

SHA1
623f709afd7fc63d01c543df9d7ce12edee335c1

SHA256
47dc7484a7e7f064cf3534f9288b7527fac264ca329e0f02b34abcd4ce95cc04

SHA512
8f79f4dc301b4d92941d7f00f8d69348ff0d8f801f2f40e730c4962cfccb6d38649707874d60243001bc13f63abc8998a4eb5f0217701de3fae7887f0c76f272

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
85KB

MD5
137f201fae663ace51a67e4afe1271fc

SHA1
47a677857af98da507c183b6442bee346873d976

SHA256
cb017d0e300dbbe8ae39c557c74c8b8c7b3501962c78a9e88176512767755cfa

SHA512
9bd7e365090609e5585affd7d99b0507b8c39662aecf6308e44821508ca268824fc7e8f976f7581bdb837ac37569aef2b26a4cf589798532d18738794ce339a8

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
166KB

MD5
6256585eee08811e20fe05f6a937bc20

SHA1
3537de9f4f296a74284181da759a5aff65f1dad7

SHA256
5395d015c411686e25ad196eb037300f8ec64fc7a0e1814d7e2bbc3a62a8118f

SHA512
c36b3c17237c7ff29927085a8ab220211cea400fc4e90d7a5dbfe2274fb34a3f7a17a56976b521948ee5918143ac2442ce08c3a15a263be884dd50d14a8ba0d0

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
17KB

MD5
d6d991c2846af5aaea2f0fea0d6163c8

SHA1
955e2dd81d68a268f3fe0aa4a2ea41c4439310f1

SHA256
6ff3ac1815092a78fc4680d78b20cfe446005aa580e0fe555c3c298c6c5f684f

SHA512
f562c4906f8c56410dc379fabfe9aa078c26fff2cd71dabac40ba4818374b2f8b894fb9c6dd6608b82764b409bcd9cae42460ef0dc9cade865d4e77440bcb7a0

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
246KB

MD5
e9de6e868b5ceb5d1d82316222f60b33

SHA1
1c1c3e5e4cad049e160b14cbb0ac0c5316550de2

SHA256
af2c0b3c8af977713188a9557df410317b0d331a61e964a02283f1dae11f91cc

SHA512
3a92f3b6f1b4ec875b17b636a7419188224ed2cf0002384ab308183f77a7f2e212a4e7ac4ba77030b8ecdde3d096ad7c9bec8258befd69eabbcf9ae070408da0

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
104KB

MD5
3eaa1b17904636b1f0f3f58a84583ca2

SHA1
695bdb3d8bc49e4b1098376c26c4966287448467

SHA256
64cd35233d5cf3258061516862b2d14d92f88e4bc1f0750e5be0f6ffd92d0569

SHA512
e836b73cc0e9229262f3e673a665fd9e8f5cec34fa42c51988d6e61f0296d9d85bd3a6125de7ef70c5a0b38d6118089f04e3d561fad1d247639f2a80c53e9814

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
128KB

MD5
05aa356b2c7f95ee7d1cc890690001b4

SHA1
b587c23b9f59ab3577020f293a5ebb9ef9d7b747

SHA256
a04e5b5f117de3ca2d9a47414e3cc95fea4fe7610a3a114e33b8089a41c895e1

SHA512
341a8eb446bb08063c03b1d4b354d103ee3246c0bf2e2b57eb9c04c4ce7c4ff4c2136499cf4ab272d27d7d5c4ff775d63aca5b254b1f7d8bd64bff918e936830

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
27KB

MD5
fe4abb2094659ac5e2c5dac0786ce3b4

SHA1
387344d0f853ebae161415f418621ac013039d18

SHA256
3de93bfb30a706d384e9e41324e9aee584f85d61d500e7affa7a0d3af8c5f4a1

SHA512
f428a54fafe4c79d36e18030761751d9eecab0c31eb62dfdda83e7d5364999f99692429ddff445d09ba127d5a0a76bcd50439335cbe3d212a5979a178d9a7abf

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
63KB

MD5
2457660d840c6cc54f8ddee54cad08b8

SHA1
f5ddb7d0f338c4ad1217e5adc47961b706f09549

SHA256
59f71c38b0bf3ea0777e4bc95a88a93aa0a05a9de67b806985cbbb643da4533c

SHA512
f24b2a01327b61ac73271c901070778d2dedf7a0633e667affc6a65b2f3837bbf9d0660b0a107108d3fc297a4dbe00ef8a5a0f4df49c8ba6f6fe9e76e9e06ce7

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
131KB

MD5
43926f4f267177991a43388605aad89a

SHA1
7234796953d005cba4c5e7867f3f66990f224122

SHA256
3c2704919c6092007b37d85c1eb297f3e8d1b622137d2a9d281d79fbc65072b9

SHA512
4ed59134d6464278b0ef88ba381c971e0635e3f387b6c3118eac59136cc37dc062aab49d5aeea473796bf2b460dfccbd08f1a6a94b215272a56de8f993d81bd7

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
14KB

MD5
6756bed7de306193336fadad0ecc4bb9

SHA1
e417def615be8a2917cd89c78779fc21f744bb8c

SHA256
d92fb3b5c0d8b0429a6004c970830aa00534c7a2b1c2b61757e8aea67cd96c21

SHA512
57a7a9821c3775001e50826e5eb9e6725708d2c3700e20182faab77a3063ac6fbea28a4255cefe28cab33ff206c07f46571396996e8e592ed3c6c326e56b0d29

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
68KB

MD5
734c7b148b3510bc671d410f7c8f2d9b

SHA1
ad156690e0ee296e7f1ceb3c12f26929dd501162

SHA256
921fbbe2ae515da357058f84d54c74801e322f61ddd252e070fccea99729c7dd

SHA512
207519e054413559849546e854aeb196217cebefa2c76810de82aada13bb16a6d112e31bcf889c0f38278839e59332f98b48039d77168894411f6995210fea14

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe

Filesize
125KB

MD5
7f348423f6b860a0883230abe7eeab53

SHA1
0908b22e627ae3aff9f56a769a019bfb9b79ab01

SHA256
588969aeb2dff1800ce36b96395c4fdb8cac46302e7d5e6a2655c4a3560240a8

SHA512
19d468cf35d84661e2126640c2ec3208706047eb3a03f1a6bdcb3d868279e37bf5a50caa37c9c6e92d545c88e1f371b36dc3e1b6f3824930ae1ecaf5e0ab256e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe

Filesize
88KB

MD5
b40a6ba4cb3f2338267abb9985f714b7

SHA1
488e06204f7f671b19b5012491e788081cf3dc8a

SHA256
e741372e6565c1e5835a8d316ddc21be0e72c81ad169b142d24c0a38d52027d4

SHA512
bdffb767e9807ced9595dc64f1f8c3b013a65ebb0f9c44c7d296d8165603433f6079cd1cd35f54b861cdc5f35d30d6c4ed72089fada84977ace654aa2c15caff

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe

Filesize
119KB

MD5
257082dc379c4b263c91b47d2f0112bb

SHA1
0523ae7a7c18d14cda09b3ee245f621c3bee7986

SHA256
09441ea5a87b455f7f99c2eb432f8ec4aff332d8000e349dfe35f9dde3d137bb

SHA512
f643c41e648f78114ad7e81dc5054f3b8440a6142b61640f51319e183587bdcbe7a4ddbdf87a7df5982f5b7b8091b56c6c8b4cc4746726736976e20d22af12d8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe

Filesize
67KB

MD5
a5490c3ecb6b5214e4289a987bf3909f

SHA1
6c7a7c212320845afb9ae4165c843b4a0eb91ba1

SHA256
8ae29684afd729f5e2f73a58874d6b0ab198684eae667e4b36f66d1f42626d8b

SHA512
dd6955bce396a0b2f30771b4467551cc1e9197e48bc7f2663a0ec5759193b5b679fdfad6fe79f9fef97db47dc6154c5fe94eb846556305b2b1fb82417f300557

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe

Filesize
1KB

MD5
0a1ddf7df6290b52ed142f18aa632297

SHA1
381110f972cc963bd316aacd2afea18ab9c6f740

SHA256
a175d8ab051bd2674865b114a001b9ca530db726adc551e9621a9f17bd78c2af

SHA512
2b64d9f5fdcc7261df8893875379ebbc7fbee8d13bc41a543c219b00152542ac156baafcf13bf97254419985ab863d5c7677e176be961f3a5faf1a5626d612fb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe

Filesize
140KB

MD5
5b39f796a4d8b1c23fb991632d7f669a

SHA1
a2f524752f7b1cc81fa88ee7917bb1fa78d971c2

SHA256
807a87edd97b8d197a65b0faf2eec76ab1b3b3f933d63dc5e28cb68dfe505ed5

SHA512
7a8ecf8410ea9a9fb85ba37d9c5276812e1cc2af1fa921b60d65c7f4e05d4ffddad3d279c5394785c57522e1d0575f1d28057027c912d490daa3bffec2cea3a8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe

Filesize
108KB

MD5
4ae380d78a5cb7691e551d4a9dae723c

SHA1
1bf1087f8047201e221086917b7f1b6974f06509

SHA256
3bb18c2aa63ee2f0f12dbf01d62d311d5b360a97a27f38e864d6dc7c4a6d93cc

SHA512
42fa8a63a2e61fcdde098cc60ba9579e9915f1bfd5c6aed91bacf9613d61c9f442c3065de6d9815bf9b9a8bf0bfdfc122c5aca802e335c06914b989f4cae6cab

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe

Filesize
42KB

MD5
10457817fb04bddba8df71161983775e

SHA1
996448d2780048d22d254cfbf4ab7b7b8fc28b54

SHA256
ead3c01d865b5401699392aa3cd64117e30f5728190a851510864c17d23673e5

SHA512
10a7217ba5d98a4f155aaba61c425ebd5489907e63daba2cb8f964d0ace7d89c6a5966d0c4b17994eee386a61c1dc86bcfcd2b59f80880ddc7ca62fea227c1a7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

Filesize
102KB

MD5
bb7c0f8f2f2b0779fcc7416ef3f041cb

SHA1
5936a4d4f157e033951cdce65e71f56d4bd39bba

SHA256
79a500e226839f5ef56f291bc4d7a4df78649582f1e6d361ba97d705f1cebddb

SHA512
4f83925a918a52c610fb962eb857a387e24202fe1ddbc298404782dd70a67d336cf86bf5c2b5e8228ab3927400ea9c11a431888d5582ea442af597b16611ea4c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe

Filesize
29KB

MD5
f91c90d0e5d3421c2013c43535ec9a44

SHA1
82cead62b3f53fe355ad24ef06f3862971e3383e

SHA256
3262e35ce2cc647ae5fd04e295c5d9c1f1ab38322ebf8cae46711cb8d56e78b9

SHA512
cb511cb4f1e550180e1d10f8f4720a2cdde9a9a746590addce44bcc7b33e2372a3643cf6b4e03991871e5f53481298f8371c8bb153569154f7f735125ebd35e6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe

Filesize
56KB

MD5
3c856b893adbbe08a135189d06fd1ebf

SHA1
7c1b43cf9a2e74f639ef3cd1818dae58bd3867ff

SHA256
2b5cbc71aa1583b9b7124adfc1906d33f8ce7ed0787f7cf9ab4e4d34795ac7fc

SHA512
93b25e7b2591a86ed19e3736b57009ec4e7575729b74ada94f0d5063b85115d235cc8a32650357868162193a9564e3f9cf603563963ec0f41deee94df62ecb70

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
155KB

MD5
44512d1fe2e619bce586c458ca003c9a

SHA1
3cc541c8034e6cf9f904bc671b7cacb8923f1e40

SHA256
0d60fe757009295db33f7b48bd61a7eef827137692c519dfce3495a03beb60f1

SHA512
d30f08c9975996e439046ab23d99ab1e61b26a5c50c3bfcd14104b7bfe6e3af095f18844cec02ed443115714173ac2a0ddf0cc85d602684457fc673c7e428331

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
223KB

MD5
73f9e0ab071b4c6d937d7072296907c8

SHA1
c00db72872ecbf7d45dc0d721c46bd3bd6dca15b

SHA256
44aae16ab09ac4c00f856e260cafe8ee35092ac86d4501e2e5cd8e9c1f0e1cc8

SHA512
734aff8b643e0625264271ee47ecd5566efc2cd5db33adbe62df18dde1dd2aaf3d63f114e496718decf460dda0a38772e1f2c7adf78433361b4688fb4c6b92bf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
136KB

MD5
9b8e404dd6a9d55b4f9e030b0139ef90

SHA1
5bebb6e87d95c99a48c3bf1f333b74b2da0ea084

SHA256
d4d5a013062f7af11c49ee1d602b9b4ac21b356e779ab8d8af6b4bb573ae40d7

SHA512
160f4d5d2400f844000905eef2a3b0bdee8307009b8184fd7bd66256f82fc6b7216a5d659008c81704ccf9985c6d9cc0511cffa1e8ff93998f93cbf35de1cbb9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
74KB

MD5
50998024679f5017ad9a86ad9c5f0cb5

SHA1
d6aacc4ffcc4746612035a58a75d7d326c0fe99d

SHA256
a0505cf976d1aea1e335ad0918a7e5243012ce1cf94bfc8d352083510090f53d

SHA512
53ed46e707ac3fd8790875c00bc11ba9f7fd1e3b502a56e44cbed8902cb0b79de3f2a47cd7a3ced690a76e72f3f87eb08df4dcaad13dad189a79639c077298e6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
140KB

MD5
8225e48ed52995b58a1564b8a9066dfa

SHA1
53a0c764dfa4f392caf8619d40849c1b06d88eda

SHA256
42e36484068058a661d13a5acdd8230b46e5186e706ea16d4b378ec7a88a3a43

SHA512
4db2a2572129d5ed8205557ac327df78bf5d26a4b05493a9a9ebf6cb7166173a3a377a510aa0f6203f934d0dbe1f89edc7a13d8d7c4e8b3c3da5fc93648e92be

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
517KB

MD5
17c0ecef0e243c8acda0c6f3dac3e8bb

SHA1
3d54f3fd0524cd315670a05e6c2d8e24d32ba149

SHA256
55391e332acf17af9f2e49f4983f5a05aa35d842e1b0ce075ef6f799cf4cd4fe

SHA512
7f36d6631487b98b072ffaa38be69d1fb38d3b48457e9c5cef67a46b12d9126a7604f09ceba43e9e3089403a95039d7f011b10b357b7942e2c779338e5571ffa

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
248KB

MD5
8a7085ba2e5ff8897716c0f1148706ea

SHA1
eec833609ab96c43f5a73d97a71343c9665c7e5e

SHA256
e79afcf66d6cbb3e474139bfe5fa6e649743c53cc8925ca8c56856aa5daa5167

SHA512
2e69c691d0a9f089c1f385d052a2a0522eee06b1ebec66b7b9cfd4ea5a68b92d4c2d6f110d0654a9b65cf1dcd806ef40fef2bb281f1f8b08f3de6e2580b6af2b

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
81KB

MD5
c96edd3e297436c8ba18ef091ffbd988

SHA1
e18492bc1e2b75c919d72b97879c17c6749b586c

SHA256
a4dd2dae22e8d9ec4ab37e9ac8fb0e87c5418cdc20f57ce5825c7e4c34622b60

SHA512
3a96971f0756f0e59c3192f71c6792a7cca04de7df4712db02332a1a28ded1a22c27f401321cd8c9e3e9d16c76f6392bff6c7559bc3077ac5a01f59bdc84f0c8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
180KB

MD5
320bba761f39583dd98ff388023cbb59

SHA1
d0a45f3580a246bf08acb705d9764b988b5063c4

SHA256
5aa56dc65fbcfd34c1c708777cb431f93d2d6b3c33690db2e4233194eb2764fa

SHA512
9133396079ca4f8ca1655113ce43877d7b78be61fa21efb7b959add63964b43acbe01377f876dd7ce83b4e63c1eb8d85cf4159cbea2e889cff163c0dc51d2ebb

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
450KB

MD5
7398ff54eddc0701ecd50e4310a0850e

SHA1
26ba5c63b8e7a0595e11e595378f43694fae385d

SHA256
a51231dcd1269ebfd936e423a3d7ba666180cc12e0d2047e1e76aa82aa54aa36

SHA512
2d2602aaf61bf904ac91c681d422bab5ad260fa26bd64dd200b3e74867bca9c576739b3418c81db0aaf81e0812501f5325fd8a8a43a2f6814b82524391593cae

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
391KB

MD5
4327461d2dcd2c8556f88ae1d8213a11

SHA1
bfbd1e1304b726b06818df30df69bb8ac3e0f633

SHA256
06efb0db680f6428e537d354179cdaa724f5ba4c2c4ee9ddaffaea2900d38b7f

SHA512
027c0b6b877e78a3c39516b6860910f70f37840d65534a7cc0f3cc70c5f909db814a22b0acb6c9772d4443e75d21f25cb5fffa6ebddabf67662395a1af427384

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
100KB

MD5
52fdc8800d7e34272b807fa6459cd1d7

SHA1
23e233dca518f2be50b4842c0e22039e8c60c001

SHA256
c365b5d123b99c7880408e672f42a4646dd0544c66c006e18209eee37ab8fed4

SHA512
776741d360b803e98257d01a33d5b61920142b299dacd1d449d34a6c50c71802ca03141213b0039510de348bbf40c6190748eeedd822aa2c3280b1e64bf94f15

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
224KB

MD5
9f5d6b0c610e3edf6dd93df25d447e79

SHA1
c0427c76f1e40b129106e910df2c11340f756887

SHA256
3e9a46e093ea0746a848d8fa0e496d44e761d81e52b2a0a021e623cf9363c273

SHA512
6c86b8cef26344d98652d7ffee7f5c55268c930917af5dfaca6b0875dc35b8b1d9e3ecaf1bc63c79f4b16d3f89273fc7fed81f5bc6fa826cedf06fadb66bc05a

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
84KB

MD5
67e090852e0234f7913e2154c6644130

SHA1
af465c8226a94cb063caaf95ffc9ec7b760077ba

SHA256
2216ae2993b55d6949c5a30f8462a871bff4f61e79ed20920e6a55a3c0db9bb0

SHA512
d19cdabdd20ef6fe9a553884178c608df05ff78bb30dcb19b29b39abbf69087111a087f98e4d36dbd4c643a9810ec0c904b7361a0e1459d50c7711ccef9deea0

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
81KB

MD5
2122e2761d2d9344bc98b14e27138768

SHA1
d9238eb603d0710ebe6dadceb96c3355d88a48cf

SHA256
ae4b153d9d775f56470530e76316641735cfcea7061e0b4b52fcaa0369f3e79d

SHA512
3bf3ea51a54ed76156e926f9989166078f119fd146271e4ae61cfb65eb8ea65fc07c69021f09d67b6193a589e153409baa4a5ed69ed035e65d55741f29136fa6

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
111KB

MD5
a4ed69e2c950cbdf41f5e468f63a6413

SHA1
46b5cc4bfa95ca27edcc9e8d23ee253cd8690d8e

SHA256
bd5adb2ec08a41708beeee2dead8bc879d3c69c622b260a7c258e1114408be1d

SHA512
bac05f8e5f06e92fde1b21c8144d67cd8aef2343b104d978128f9c21239da606a1b42977e3730aa6e029d11689f080b8a9ea4eebdf39fe86a2ff440fda5083dc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
286KB

MD5
225b9a145a798947b0ba77522dd3d502

SHA1
782eaf07c201b42ba9b27982bc9b4cb55e6bf312

SHA256
6aee33b4c2dbcd9df1f51922255ca733820e09f96b6e9a27cb98b5922e389a82

SHA512
d95ce0f2990c3c5b2b555ea9e937a77bbc2840ffee557ac7e619a7ae22de7aad4e12d9dc46f07dbc5ffb1d336acb5d7a7cb16596ecb41bbae332cdb4b3b61206

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
240KB

MD5
e5f9aaff96700f2e18a515f2bed55a47

SHA1
05423dcb6b112e14dd85b9a0c20785c238d1181f

SHA256
91ff3a2d0dc0dbb8a09850eb419547dee3654d6571ae42380f30d9942acccc36

SHA512
b1feeff5de9a0d1786a5def7923484017b5a40a36bc681604eeb43b8df8083779c6d90f8fa1606d81945a6a42cbbfef1a44e5519ec77956ac413928ce58452b2

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
243KB

MD5
21f863d931e3852ad1d95298a0d6d095

SHA1
8b03cd870ad1011dceffef82365947c979df76bc

SHA256
7f5c9f183264056a2d10e31f09b8d6cb7b872d8b4f06177053271374a884e107

SHA512
305341f119bf1845edfff8796935261d8d0cb614e9c8d9dd199f05c37846244d31960869075dc269a7424d9466aa2c60ddd48c9f6a20dc67f9311ffa961b639a

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
9KB

MD5
2de49d6dc92eb992a40108ad15757170

SHA1
55cb0a78df1547336792a89a76133f283f7917d2

SHA256
1831199fd499cee605fd3d1312ebeb18d22db21d3b87d571d8acb64c26a09144

SHA512
963e7ba5d5ee1da0c760fc9c976f599e0d475e7575755fbacfa3cc3c3de186a7ec6dc4845f5765c7b5f283209aabd7e16ff570b2f9c8481965a49b8a74647395

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
111KB

MD5
dd0292ba773cf859bb7561557191b311

SHA1
2dfa7cb9b237add7b833b1e6d0441da95fe0ee0f

SHA256
ada6eb0456d7fd0d82d13831d5a6049705ab8e740ba9b04d561ce77bad7ef61a

SHA512
d118cda331f45d531fbc3d54b2b5f46fbc6c4be5e97e412fdcdecee275802e438bf01f5bf23d6fe9d5e07b63b696f5bf50c55b155f3719e756f6c1f5dc385dcf

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
136KB

MD5
58a4330963568a652917e7e3c357215b

SHA1
4ce38a64dc10de1fb29d7d3e444f3d932b31831a

SHA256
95c75fabb405dd6387433f47e5577d2cd1dcb6ceac9ee4643d269599b04fbd55

SHA512
e0cce687df32253a0d2cd1d24308e558f6918664ffd9d47d553263b48a78834a89d59d296a74b3f804c4d75d8212550c7e0781eb2073052a9c6c0f71ab564310

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
29KB

MD5
3038a76f8130b1420f7f54eb4306b2c1

SHA1
2862a659db80dbb818306fcb422b8e30d3ad58ed

SHA256
67bbfc2d455f01128ba534f28f1707c29ad34fff974bde7d0061f2d11252031d

SHA512
69445a2a35bb280541320b7f7205f7a31737cef5c7bd1a94107b566db7549adfc2d513c3f6cb952c94c17e58893dfa54dc17e31a1bb2dae0b12ed550a367d7f0

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
38KB

MD5
ce1d8630613f15c11dc9d5aa362bd915

SHA1
4118b7b2f4bb3ea07cc777dea51e526d51bc3946

SHA256
7223b0d90687600c642a2d0ced2f97962c3d5df839623bfdcac1992a685655df

SHA512
fd1664b014f0337e1af59e60d673586635f513979824a4378e10853f718f102f742b4660cdb6dfbb387b659831ad197fd74fcd7d632330a2fc50e3b63815b74c

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
64KB

MD5
cd579522753c6ef4a0d204420cf51669

SHA1
5e5371b1d1c50b688ccfb3ad52f21fe8a48e4c83

SHA256
408cf0933787cb2dc623605ad2235e3630aa6666ad1e4570f4b5404f3ba969f1

SHA512
22830f15beebc8b5370caaf04d5ef75fff10d6da08c36dd73619718f7aa732633dd18aa1aa7277a16b4f6339b9c4ba57ae705aabcc2ea4d562e5f222deea000a

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
10KB

MD5
94235754c375d0d6795b80ca87e1a928

SHA1
ad7715545194068cbbae439aae6794266d1c780c

SHA256
885d253af27a0e29f308ddc88f0a019cad8cacb7de39eec609cfdb4e5a01ddbf

SHA512
76ee07e2f8ded3b343bd5b3dcc9e27310ef9e1fdb69fc6f48e3e42aeac39aea96ffdd08393a958b161397240532623a5e51d955ec37d09f9df1787f25fa14f18

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
81KB

MD5
6253be87d97cceba65be0fdbc49a7939

SHA1
e4812c6829c629a1a7980c3daaa1cb74b66b254e

SHA256
a0b1f318ad3c5cb73704f5d29982fbe7af1f38330c11b43e834c784e10c4847d

SHA512
a6b72166688b326c3378050d4deddb2e11bdd529eead18b2078b95f8dd892f28a98c2124cab8c7aa65df8af76868905c6dcfcec032f639b35bc9a35c92ec1428

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
61KB

MD5
6db83ead172dddb9d25e298627c5f25d

SHA1
251188cc90ff48a153eda15a92824fb828776187

SHA256
a3e93caf22261d1c32c076fcbb736999bec89c9668e39ba7c8cce9d40fda365c

SHA512
411b1709e38138cf04e7da263d2456eec3527482e72d7ea2c5f3e6d8f4c2ba698fd2d46ad974321e502a19222815db141594f8752b1fbaaf6bfa97627d1578b0

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
136KB

MD5
aac8539c10ba6c0a7cd34e66c073253b

SHA1
d8447af51e4f454996a899f322521d01b7f7d97c

SHA256
365f7b1f56d3679629a6208297c86664d4c88c3c761cf5e4c828df098da95b85

SHA512
2624d9c8248e85dbb8259ed358408752b8c8ccc270cbc3a31317d646140e2f45711d0b43363ba9e9bd722c10398bbba11d8bd829bea3a9cb479390f1787d4f79

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
27KB

MD5
c64d2f48dc724d75d5144c45e4b58aa1

SHA1
ec54702dea0404e38999c3cfa3d474243c77c256

SHA256
7b5b9580f646eccc448d1267ec5c007af1e2c0262c657fa4f6dd2f042dc0501f

SHA512
578230781a06ec31889a7d4057e60800ef96fd19f7b8e5c72490f10b0f4e0209688798859e6d624cdff69f206ea35578dc85367e261c1af881fd639709793c73

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
b1651a2a56abce0d1d0e0caab4dbc4c9

SHA1
d397ab850acd1943bc8a4fb2a090aa4d08fd1c35

SHA256
396a1bcb10e05956ebb5bf956953fec2de2d5ace7fcf92eabc99830cb59c9f19

SHA512
39b3d49f7dfd6c92530fc6e06af22f7afcdf22c3a6405f4845e308afed8fff4371bfe6a33f0c51b7959bf51f493c11b7b05f3efa598cbe011832fb91f4161766

Download Submit
C:\Windows\System32\alg.exe

Filesize
702KB

MD5
0f1a909c0873902d9b9eee60745d010a

SHA1
696ccbf5c24f00aac876db6eb4a5a58a11f906ec

SHA256
ffb16c560c4b0d376044b71f04e11f4d874dee036855fb4e33cd8ea94461cd8b

SHA512
06bef23cb6f39f8520babab0609614efa58ac87223446168c77e5f8d8e9d82d0ef0c335251db4180bbdba0468a763b1f152f776e2f6bd64e8b5cfbcd9dcc6f46

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
269KB

MD5
d725a651a53f7aa4089837355ed0a36b

SHA1
220a17a604f417d042820a1e81610973f8e9d3c2

SHA256
26246961f1707b6f482dc2e744b322adc0b2133a9f6d90c5c39cd98beaf1c634

SHA512
99df136461f3a0c15037989ade6c1ed69e0f364734afd8093798dddfffecbafcbf4219320ecf82614c71dbbc0eeebad5a079897e280a4dcecd8b46f7fd090bd3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
115KB

MD5
4393e911c5f634e1d7a231e6d9f8fe5c

SHA1
97396c7a2d4becb6bfc19d550fc5945db4be2415

SHA256
465a9593f9d3c8db7c66e205a910e1b1ecf82cb9c21dd191dd83df6a1e112b43

SHA512
f15760484f3a02f52fc66f998a20a62a609e4f69c914dbaabc16db2e70426c42ad7bacc14d6cf53e5c38e611b5cf1d857ed02873e7b5542dfa57ffde7c7fe957

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

Filesize
148KB

MD5
ac901cf97363425059a50d1398e3454b

SHA1
2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

SHA256
f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

SHA512
6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
34KB

MD5
c26b034a8d6ab845b41ed6e8a8d6001d

SHA1
3a55774cf22d3244d30f9eb5e26c0a6792a3e493

SHA256
620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

SHA512
483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
15KB

MD5
322897ba56a6686b1a317f115b2eae96

SHA1
cf19569790318d9c6412d59f986925e651d7a24a

SHA256
7beaec5d471d5c0c18eadc1cd88829f29ed85c18cfc941248da952bfed6bd4c2

SHA512
0e0b1d0de2d1e75cbfa13bb922b5b23b0dbaf7452aa9d4a7fe35386610b18bc79dd3d56e492b835cf0b5252e162f6e2a6f9176a126423af0eb08bc67901cda7e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Filesize
41KB

MD5
3c269caf88ccaf71660d8dc6c56f4873

SHA1
f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

SHA256
de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

SHA512
bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4cffbd6c354740026d7a3a29dd63e3bc\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
143KB

MD5
1fa4c663eb7f4f3f5e7547c8d2849c90

SHA1
7a2e4dc0eacfaab69d5ddfcbf9fcec8ff55b035f

SHA256
3febbc6242bafabbb51659ed696758cc75dadcb7ffc8217b8a032590d97d9166

SHA512
3a40a81785cf707abfb6b5f88b98e6cf413391b4098d1199a1cb7f030fa2e45c3c8502ae6baa7ff56f1476ee700d5f126c14a99433802a1dd328cd66bd9dfdd9

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
92KB

MD5
02a756ca0253aed38f7303ae05e0b88a

SHA1
c236f3161f8a7a1d5cc3cae9bce65b37730f6c9a

SHA256
83b359a99ba006bc6965d43e70eab2233c6127b7a1e41216e702c9f5e5e1237a

SHA512
c134dc1f53fa9828d626aab2b82928ef7ee6ab7dfe7aad6feee04b7dc714a31e7a2205b6e1f5fb719af3c1d7da09c12b99bc1fc16ce41a2a178cd0def4d46516

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Filesize
35KB

MD5
eb75dc8fdbeed12a9f63a09b5631c1df

SHA1
ed4c26941e45e9f02b16ec366b5265f9514aad68

SHA256
4f7983c3937a5d4f8425f731c17ce47cdc4482e247ee945a0ae3e6b3e72b7394

SHA512
4b0385c8f1beaeba8be086d27ade2c003e2da5e173ed85f5556d7a6c4a5083ade620452df0f83bd4ea0080d91e8252f6e36937c71e74f6b131331ee54e2131c0

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9ad3fd83f63f58c33749dd5f390e3598\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
83KB

MD5
2cf98c9672a5160045f5cd7e8337f85d

SHA1
c842e154f139999d449cf7efb553439e06c2295c

SHA256
f481e3118fbf499b74c7221781c9cd80776e0a61c9386a17da2fe603ab99bcae

SHA512
d73705f4cbb23015d7938f6c7e7e029e5eed696a6e233f3f2b2eeff5730fa1b90d8d09bce047089ecd3ab1755185d270805777dadbce68e7cc59536fb11cf003

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
28KB

MD5
aefc3f3c8e7499bad4d05284e8abd16c

SHA1
7ab718bde7fdb2d878d8725dc843cfeba44a71f7

SHA256
4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

SHA512
1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ba7f88efbe691d22cfe3ef8fe508d54e\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
42KB

MD5
4ff84fa0c913ee9b7a9130e422141fb3

SHA1
dbae5305c70020fdc2cd2d66a70a9f3f3e3979e3

SHA256
2557c9eecfef286363050be399163d31345f0da33ae82f214a76a536d32eb405

SHA512
fe3cc4b7c2a1bd642650bff13e7b5438d2bf7ada8ba6e9486bd1262c81e94de880515da57b9537dfb1fa8b24522e2409354ba76270b2e9cf8cfb7806ac4df3d4

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bbeedf96f85fe3f28f55d0989f64fa48\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
187KB

MD5
b3a2512a002e4acc5d5c638788ceb39c

SHA1
6190eb3c6a95929abf5421078ed55de8cb11998c

SHA256
dbf4b7d1f4a849a45261cccd9d4862ddbd34902bcd4083f3772bdbb27778a26d

SHA512
117f42a8fab9fea45a8cf59580843efbe8b3c652750d48f9b7b3c2506dd6489a00b56346b2a6f25cde36ca50b0b796cf012db1f0580ea59a1b9b16e668990727

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
27KB

MD5
9c60454398ce4bce7a52cbda4a45d364

SHA1
da1e5de264a6f6051b332f8f32fa876d297bf620

SHA256
edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

SHA512
533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
57KB

MD5
6eaaa1f987d6e1d81badf8665c55a341

SHA1
e52db4ad92903ca03a5a54fdb66e2e6fad59efd5

SHA256
4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e

SHA512
dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
130KB

MD5
2735d2ab103beb0f7c1fbd6971838274

SHA1
6063646bc072546798bf8bf347425834f2bfad71

SHA256
f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

SHA512
fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
59KB

MD5
8c69bbdfbc8cc3fa3fa5edcd79901e94

SHA1
b8028f0f557692221d5c0160ec6ce414b2bdf19b

SHA256
a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

SHA512
825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Filesize
42KB

MD5
71d4273e5b77cf01239a5d4f29e064fc

SHA1
e8876dea4e4c4c099e27234742016be3c80d8b62

SHA256
f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

SHA512
41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll

Filesize
100KB

MD5
80d994de2b9b8f58f2a0a3b59fe81751

SHA1
18d23a37ab4918ac3f319e42b9fe2967f0c87c8b

SHA256
cb320b5e4361a773a52a8fef75287a254b35c1c8a7c50d830ea792f7244f7081

SHA512
a72d5e43a700a950d853a1ed458c9cb2c3e99a085b051a8d6151d93e79167d7284af3a1ad6d0837095d781344f33c35f35175f4cb4d6b7a88fe9db7ddcc62b10

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll

Filesize
43KB

MD5
3e72bdd0663c5b2bcd530f74139c83e3

SHA1
66069bcac0207512b9e07320f4fa5934650677d2

SHA256
6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

SHA512
b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
122KB

MD5
d68f9c4c136229964e7e211895c0c285

SHA1
0a0456098dce751a611fdb91ffc09774bc6b2df4

SHA256
a1d48740f19cc21fa6c760ee8fd4bd63a22e7b404619fc21a84b1f118ee66940

SHA512
401e1492db5b2d2a55c4dcdb1fe6a0122d10a3f11064985ab5c3744f89f9b475305e573a37f6245901b70f1e813e0258b9295b8acd2f98bcab0bf8c64d11e13b

Download Submit
\Windows\System32\alg.exe

Filesize
832KB

MD5
902c673b22784ff1ef76355d38fb8f0c

SHA1
2c5784246a5d8839f71277855554f6b5d359044b

SHA256
469427b2f1f04120b74edb7c8fd45cc22e01559e92000e89962c8f47af2cb804

SHA512
5d5bca376b06aac202015d45d616f8badcc8429b94232350704bb1b1970ddeed894e6b96e81f29ce8fd11529442db91f8a9b8cd3b4b39456bb33566bd54e68d0

Download Submit
memory/524-465-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/524-426-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/524-418-0x0000000000570000-0x00000000005D7000-memory.dmp

Filesize
412KB

Download
memory/524-468-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/524-404-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/556-263-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/556-202-0x00000000001F0000-0x0000000000250000-memory.dmp

Filesize
384KB

Download
memory/556-210-0x00000000001F0000-0x0000000000250000-memory.dmp

Filesize
384KB

Download
memory/556-203-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/896-242-0x00000000003B0000-0x0000000000417000-memory.dmp

Filesize
412KB

Download
memory/896-362-0x000000002E000000-0x000000002E175000-memory.dmp

Filesize
1.5MB

Download
memory/896-248-0x00000000003B0000-0x0000000000417000-memory.dmp

Filesize
412KB

Download
memory/896-244-0x000000002E000000-0x000000002E175000-memory.dmp

Filesize
1.5MB

Download
memory/1096-255-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1096-286-0x0000000073CF8000-0x0000000073D0D000-memory.dmp

Filesize
84KB

Download
memory/1096-376-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1096-266-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1096-416-0x0000000073CF8000-0x0000000073D0D000-memory.dmp

Filesize
84KB

Download
memory/1096-261-0x0000000000850000-0x00000000008B0000-memory.dmp

Filesize
384KB

Download
memory/1692-179-0x00000000002D0000-0x0000000000337000-memory.dmp

Filesize
412KB

Download
memory/1692-241-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1692-172-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1692-173-0x00000000002D0000-0x0000000000337000-memory.dmp

Filesize
412KB

Download
memory/1708-507-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-503-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1708-491-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-480-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1708-488-0x0000000000360000-0x00000000003C7000-memory.dmp

Filesize
412KB

Download
memory/1784-235-0x0000000000FC0000-0x0000000001020000-memory.dmp

Filesize
384KB

Download
memory/1784-227-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/1784-225-0x0000000000FC0000-0x0000000001020000-memory.dmp

Filesize
384KB

Download
memory/1784-232-0x0000000000FC0000-0x0000000001020000-memory.dmp

Filesize
384KB

Download
memory/1784-239-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/1964-422-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-424-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1964-397-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-378-0x00000000006D0000-0x0000000000737000-memory.dmp

Filesize
412KB

Download
memory/1964-371-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2180-450-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2180-458-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/2180-487-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2180-490-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2180-478-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2200-513-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2200-522-0x0000000000570000-0x00000000005D7000-memory.dmp

Filesize
412KB

Download
memory/2200-537-0x0000000000570000-0x00000000005D7000-memory.dmp

Filesize
412KB

Download
memory/2200-524-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-194-0x0000000000420000-0x0000000000480000-memory.dmp

Filesize
384KB

Download
memory/2208-188-0x0000000000420000-0x0000000000480000-memory.dmp

Filesize
384KB

Download
memory/2208-187-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/2208-252-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/2400-495-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2400-514-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2400-519-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2400-502-0x0000000000B40000-0x0000000000BA7000-memory.dmp

Filesize
412KB

Download
memory/2400-517-0x0000000000B40000-0x0000000000BA7000-memory.dmp

Filesize
412KB

Download
memory/2400-508-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-219-0x00000000004E0000-0x0000000000547000-memory.dmp

Filesize
412KB

Download
memory/2408-282-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2408-220-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2408-214-0x00000000004E0000-0x0000000000547000-memory.dmp

Filesize
412KB

Download
memory/2512-168-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2512-1-0x0000000001E60000-0x0000000001EC7000-memory.dmp

Filesize
412KB

Download
memory/2512-0-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2512-7-0x0000000001E60000-0x0000000001EC7000-memory.dmp

Filesize
412KB

Download
memory/2652-384-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-363-0x0000000072650000-0x0000000072D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-379-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-360-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Filesize
412KB

Download
memory/2652-353-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2756-535-0x0000000000340000-0x00000000003A7000-memory.dmp

Filesize
412KB

Download
memory/2756-530-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2780-88-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/2780-80-0x0000000100000000-0x0000000100164000-memory.dmp

Filesize
1.4MB

Download
memory/2780-82-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/2780-222-0x0000000100000000-0x0000000100164000-memory.dmp

Filesize
1.4MB

Download
memory/3004-238-0x0000000140000000-0x000000014015D000-memory.dmp

Filesize
1.4MB

Download
memory/3004-94-0x0000000140000000-0x000000014015D000-memory.dmp

Filesize
1.4MB

Download