b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5

Analysis

max time kernel
4s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
Size

1.8MB
MD5

4341695dc2e22798a48feff8b20aa32a
SHA1

84f2e1304ebe07987736977ecf028a91f88c7c03
SHA256

b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5
SHA512

789dbcbdee4645b099b6c3407623ce838aa14ccacf1799fb71e932b4964228cb6d78a44d57e231fe683f6b5e0b9cdc6fc383d901d973ba4fca5fc96284d8e99a
SSDEEP

49152:5x5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAe/snji6attJM:5vbjVkjjCAzJLEnW6at

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
472	Process not Found
2308	alg.exe
2200	aspnet_state.exe
2872	mscorsvw.exe
872	mscorsvw.exe
1756	mscorsvw.exe
2848	mscorsvw.exe
1768	ehRecvr.exe

Loads dropped DLL 3 IoCs

pid	Process
472	Process not Found
472	Process not Found
472	Process not Found

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16fca3a493c0dc56.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleUpdate.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_lt.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_pt-BR.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_da.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_gu.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_pl.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_cs.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_es.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_fr.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_te.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\psmachine_64.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_fa.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_it.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_uk.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleUpdateSetup.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_hi.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_iw.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_nl.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleUpdateCore.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_fil.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_kn.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_ml.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_sw.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_zh-TW.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleCrashHandler64.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_bg.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_fi.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_hr.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_ro.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_tr.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT584E.tmp	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\psuser.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_ar.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_id.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_vi.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleUpdateComRegisterShell64.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_en-GB.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_is.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_mr.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_sk.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_sl.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleUpdateOnDemand.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_no.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_sr.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleUpdateSetup.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleUpdateBroker.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_es-419.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_hu.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_sv.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_zh-CN.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\GoogleCrashHandler.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdate.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\psmachine.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\psuser_64.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_bn.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_de.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_ja.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_ms.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_ru.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_am.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_ca.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_el.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_en.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM584D.tmp\goopdateres_et.dll	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	760	b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
Token: SeShutdownPrivilege	1756	mscorsvw.exe
Token: SeShutdownPrivilege	2848	mscorsvw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe
"C:\Users\Admin\AppData\Local\Temp\b7363b8185568097c73c792f8460f75bd6f7a9e85868630aea731f9957f365e5.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2308

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
PID:2872

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:2416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 254 -NGENProcess 25c -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:1300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1ec -NGENProcess 248 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 240 -NGENProcess 264 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:1916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d4 -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:1324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 268 -NGENProcess 1ec -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 240 -NGENProcess 270 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 270 -NGENProcess 260 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 258 -NGENProcess 238 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 27c -NGENProcess 26c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 270 -NGENProcess 280 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 268 -NGENProcess 284 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:1524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 288 -NGENProcess 280 -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 290 -NGENProcess 288 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 270 -NGENProcess 260 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:1796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 294 -NGENProcess 28c -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  PID:1356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 290 -NGENProcess 298 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 264 -NGENProcess 29c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:1696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 26c -NGENProcess 298 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:2116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 288 -NGENProcess 2a4 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:2616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 268 -NGENProcess 298 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1cc -NGENProcess 294 -Pipe 1c0 -Comment "NGen Worker Process"
  2⤵
  PID:2792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 2cc -NGENProcess 298 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:1376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 1cc -NGENProcess 2d8 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2c0 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:2012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2dc -NGENProcess 2bc -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:1204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 1cc -NGENProcess 2e8 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:1680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2c0 -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 2e8 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 298 -NGENProcess 2f4 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:1172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 1cc -NGENProcess 2f8 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:1648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2e8 -NGENProcess 2fc -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:1800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2f4 -NGENProcess 300 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f8 -NGENProcess 304 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:1316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 308 -NGENProcess 300 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2ec -NGENProcess 30c -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:2612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2e8 -NGENProcess 310 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 300 -NGENProcess 314 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2f4 -NGENProcess 318 -Pipe 1cc -Comment "NGen Worker Process"
  2⤵
  PID:1724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 318 -NGENProcess 310 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2bc -NGENProcess 320 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2e8 -NGENProcess 324 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 310 -NGENProcess 328 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 304 -NGENProcess 328 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 330 -NGENProcess 32c -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:1992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 320 -NGENProcess 32c -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:1712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 324 -NGENProcess 338 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:1600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 310 -NGENProcess 32c -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 340 -NGENProcess 2bc -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:1260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 324 -NGENProcess 344 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 320 -NGENProcess 348 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 2bc -NGENProcess 34c -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 344 -NGENProcess 350 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:1292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 310 -NGENProcess 350 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 348 -NGENProcess 358 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 354 -NGENProcess 35c -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 350 -NGENProcess 360 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:2156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 360 -NGENProcess 32c -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:1172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 358 -NGENProcess 368 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2bc -NGENProcess 36c -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 32c -NGENProcess 370 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:1100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 35c -NGENProcess 370 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 368 -NGENProcess 378 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:2232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 374 -NGENProcess 37c -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:2692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 370 -NGENProcess 380 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 348 -NGENProcess 384 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 37c -NGENProcess 388 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:3024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 38c -NGENProcess 384 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 32c -NGENProcess 390 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:3012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 370 -NGENProcess 394 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 384 -NGENProcess 398 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:1428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 39c -NGENProcess 394 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 380 -NGENProcess 374 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 3a4 -NGENProcess 378 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 3a8 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 394 -NGENProcess 378 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 398 -NGENProcess 3b0 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:2328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 3b4 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 390 -NGENProcess 3b0 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3a0 -NGENProcess 3bc -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:2632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a8 -NGENProcess 3b0 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3c0 -NGENProcess 390 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3a0 -NGENProcess 3c8 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:2840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 3bc -NGENProcess 3cc -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 390 -NGENProcess 3d0 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3c8 -NGENProcess 3d4 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:1008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3cc -NGENProcess 3d8 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3d0 -NGENProcess 3dc -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3dc -NGENProcess 3d0 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3d8 -NGENProcess 3dc -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 3cc -NGENProcess 3e8 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3d0 -NGENProcess 3ec -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:2396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3dc -NGENProcess 3f0 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3e8 -NGENProcess 3f4 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3ec -NGENProcess 3f8 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3f0 -NGENProcess 3fc -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:2108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3f4 -NGENProcess 404 -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3f4 -NGENProcess 3d0 -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3d4 -NGENProcess 3e8 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 408 -NGENProcess 3dc -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:3000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3d0 -NGENProcess 40c -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 3e8 -NGENProcess 410 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:2492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3dc -NGENProcess 414 -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  PID:2316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 40c -NGENProcess 418 -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 410 -NGENProcess 41c -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 414 -NGENProcess 420 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 418 -NGENProcess 424 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:1360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 204 -NGENProcess 420 -Pipe 428 -Comment "NGen Worker Process"
  2⤵
  PID:1396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d0 -NGENProcess 42c -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 3e8 -NGENProcess 430 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:1628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 410 -NGENProcess 42c -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 40c -NGENProcess 438 -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 3d0 -NGENProcess 43c -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:1344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 42c -NGENProcess 440 -Pipe 424 -Comment "NGen Worker Process"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 444 -NGENProcess 43c -Pipe 204 -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 444 -NGENProcess 42c -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 444 -NGENProcess 448 -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  PID:1112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 44c -NGENProcess 454 -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:1796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 42c -NGENProcess 278 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 448 -NGENProcess 258 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:2620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 454 -NGENProcess 444 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  PID:240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 444 -NGENProcess 450 -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 258 -NGENProcess 278 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  PID:988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 44c -NGENProcess 444 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:2284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 454 -NGENProcess 440 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:2124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 448 -NGENProcess 410 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 410 -NGENProcess 44c -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 410 -NGENProcess 448 -Pipe 444 -Comment "NGen Worker Process"
  2⤵
  PID:1836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 278 -NGENProcess 44c -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 45c -NGENProcess 464 -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 468 -NGENProcess 44c -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 460 -NGENProcess 464 -Pipe 468 -Comment "NGen Worker Process"
  2⤵
  PID:2716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 44c -NGENProcess 474 -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  PID:240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 478 -NGENProcess 464 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 470 -NGENProcess 47c -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 480 -NGENProcess 464 -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  PID:1492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 41c -NGENProcess 484 -Pipe 470 -Comment "NGen Worker Process"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 488 -NGENProcess 464 -Pipe 478 -Comment "NGen Worker Process"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 464 -NGENProcess 448 -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:2108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 464 -NGENProcess 488 -Pipe 484 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 41c -NGENProcess 498 -Pipe 490 -Comment "NGen Worker Process"
  2⤵
  PID:932

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:2128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 230 -NGENProcess 238 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:704

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
PID:1504

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
PID:1264

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2148

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
PID:952

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
PID:1924

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
PID:2112

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:2580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:780

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:1388

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
146KB

MD5
d1a9489af807836a625a6cdac6c5fef0

SHA1
477f0ecec1ff0193cf9df6393bda69c8f1d5ff09

SHA256
558adb9856f7b41e47e4acec67b210a2e363a1f638590a9252d3e4802532b258

SHA512
0f7ce46e5984474447c16cfde88f5e4fff05c229d302591926bf98572be3624eecf54f8bfc046ca7fd01703ee8966980e4603ea959be0bfe5008358cc4244b0b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
200KB

MD5
eaed73abea80fb6769dac12f489c813a

SHA1
140efb4125e4cf384b7f72ae89b81e3bed8d3ca2

SHA256
d6159f5a62916b65739f157bad2a9a8a05dd7f8b31d894e5b20647084532ca97

SHA512
493126fd38cab8a47a91b8787612fb4707881f6b86c9008d03adc2dd1f52ecee45fe11f10f5b7efcbde37fcca80063f23da6736af319a98e35d3fcbe759aab22

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
173KB

MD5
80afd0b6d2a6079fab1ed550be0dec50

SHA1
b29840f8495836fb6e690b43605437cbe3e4ee98

SHA256
b95828876044661b62856c4ff45dd21b571013f9503f5793a3ea897b878dc8b6

SHA512
55535489a4b2600bcaf92c1fe1e3f53dce7a3e35ae7164060008c38f434d08ad24acfb2f661d1d12bfb63e578be6879cc3435888daf172606894de2f7541b309

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
235KB

MD5
d536bc6676b3bcb81786d948e85c6e6e

SHA1
8042765cc2b13f81b2cf75c5fa6ea0f283b7e220

SHA256
0ef2b78929ab12165b8bf78245671e73d19a53d8572a242b5ce6bd22f3c9a055

SHA512
ca707ce94d33fe9bb8ed44ed26cd271d5ddc643a84cf277cc14cd3cfaba259f5dc547852ebddcff3087c333183258f48ee20e852003fb1d8c44f467388ff821f

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
53KB

MD5
349378111ab16827ed8ab4c32c38243f

SHA1
16ebdfd7118e5b4149cec5e81a4e90839e1a2bd7

SHA256
3b23ac815ca66c2c88895409115987ba21ef38fb9820680618a118b46d3e23e8

SHA512
089abb02516cb999c1ecbe9d4d2e1b9d706ea27779570db245aaf7721dcd13e23eceeee090327d8c4fdcec71a5e3363b599c55bc207785226679b1806d588caa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
57KB

MD5
528600ef8869b2608ecc9ece21916d34

SHA1
081fedf3223864049c0502f9a8502f7d06847d70

SHA256
4bce8cf65ebc83c08e0cd83930ef84d4b23876349d3e9981c788a3046257af73

SHA512
9341e9ba7e454e73bf8a7ae4cc2bd7a5d4dc4781ae0fd14c7f870a2c7d7ac6d255882e2ee32e8c3e72b09ef1d93032572348ea0523a126ba64722ade392d64b5

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
102KB

MD5
3e05d276e86ec0040a4f098a6d853d04

SHA1
aaa6e3fd71b2b149d7192d23c2b0ffe1c49f6c96

SHA256
8524f878078a42c99cb0c8a08dc69c003a715ed89b1cce57ac2fa7c92c40802c

SHA512
a0267770896b8b33a5511f68d8225c3bf73ff99ade6c613ff3482120cb0fdde68e4a7c7cf496bc7517da1867cf581bcd42197907e8023fc637a56778ea4349d8

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
104KB

MD5
785581cf024b00fa7465beb1d2ea8b58

SHA1
d891b7bd8f84932665cc82664b82a55fe3b7db99

SHA256
310cb80c1b2347c49596eebdf87d97a0765b0cbc69e8d16d57f53684bd444d40

SHA512
1e4d952cd9e0cb5cbdd93eeff2e00448710e7da2e80c875752022b3ca310f599d72188b971d892e7995335c922b5a30347196f3d3a7d457ae9fe194fef72f498

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
224KB

MD5
c0a74bf6bcf67acba6d7a95f622dfffb

SHA1
df7652fc9d82d793805b86bc5d50e5005a244ddd

SHA256
9e7366ae470784e16082db7c2a26cb40bd52504dd1b0e9d20d03ced83e579a9a

SHA512
62df8fb912f8cf13ebbf2c7c3dafb9b4f48345fd9e5701990f5864fb66859f5bcc2d264f300bf76711fa554ce15c6e96c701204bdbf92cc90dcf2606ecab1993

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
108KB

MD5
1afcd4ab16354e129673d2c588f1a87f

SHA1
012606280b339e5e900c7bc928ffe95cb959cf3b

SHA256
acbddf7eda3ef7d248df710a5541d789800226353651e283bd53dc596431b2a8

SHA512
2cceebabc38f9bc1016db8b4906d5cd65691490db14a4b031f7fe18e0c2215919981f4ef79c1b78e4ea13288eff76d8183a7e5fcf269fcffb40d1d7bbbb7809b

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
172KB

MD5
f036bfd44d262fe839ae0489c4194d29

SHA1
80447df19aca721fe29083e23701ea95ae8a7d65

SHA256
2d356a2211e1354dd3b9d9f4860245ffe9de4ad0914cd9ffb617f4d5c87d699d

SHA512
b234e18d0e8724050226f9ab9fc47eb01a7bb6669cb88003b6328a55074e81abdde392fa71a609db4b68f4ab0b9b41c818e00a70d5ffe3246a18e66aed1fdf0f

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
168KB

MD5
c88d1706c633490b81ce288702f1f1ba

SHA1
1c48cef2e9d96df73842b951a780a5af31bbd26d

SHA256
27ae073ace58b472abb2b707066e4c97892447a1f59607130846ec759c45ff6b

SHA512
5e4061b2fb1a121495404506c4751f694e5470b52b6c2227dbe02fcd445e27ff50ffac8e31115edaec8bcfc6deaf5360f4b928d5f593ce92df486c145ce9cbfd

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
22KB

MD5
6e11923f9a64235ccbc62203a8ba0223

SHA1
b4ab7fa23a4162d3348abd3ad536bbd296bd12b8

SHA256
c5e71a33cecc16ae9b447c150f0f761bcc1a589a7436c7a3116b7fb9b7e36a50

SHA512
c08ed7ffe71d1def522aa4717bd13e5a0ebea0f9c649cddc0db4214e604efcdb3caa4965753bab960eafb132a6b1146113e4250d8e5d4d865025a58e293c50d8

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
116KB

MD5
529fc74d5f8050cdf3e0e263aab2033e

SHA1
8a575f54a6ab93d2545e775bd2cedcdb458d5f46

SHA256
ddbf6d6ffe1decf9ed261331da6e21588c1e80c51fee09d07da7ce80fa4d2add

SHA512
13fba2658cea648695f6bbf576eb58f2d11f75d9532191c60788ca2d9d1d2284c3d9a5a523ddf67abfc4d127d3d924703d27a60632fe7a7d8e112750aac06195

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
134KB

MD5
9397daa92691b5b6abe38d86939e62b4

SHA1
2c921e476819d4e928cc1d6fa973104411fc6f9d

SHA256
1f4324e913af04b20a362c87f3d38d8d44040d8ea782893122a780ba274ab42c

SHA512
6f136576090c50f52818a503d1f4a0a9b7c4fb93a6f9398b936b79598b01c2149af367ec7d7d65f8745610cb311990d3f083eb06686345a1e74a5ebc91022a1b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
217KB

MD5
31536508ac02b00d373329e63fa96730

SHA1
5e79d3ed13fd872da9772313325eb65b90538a8d

SHA256
3fc79c3c7f508313fca21a016f7872bc5bee226fde7056fe5c883de79e12b881

SHA512
ef30577c4659d3e78d7b50485f5c3cbec3caee82128766e36b2e72707add57fe2bed7fd547f649aec20425d8825460e15e8a210a5e2095da53d7bd4720d78cad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
121KB

MD5
4a142fd228861e7bb3889a4478c55be3

SHA1
f302e7af60faa0e4857ff467179aa78346a8ccca

SHA256
67a66a01ceceb0c4b4ff0af5eb307b0b00fc2d65b4b1fd9b775757f9f69e2295

SHA512
e8c822746a6ea3cecc814684263f7190fa4ad1ddb53f98f8e15da7c3198e0eda62eb63d73dfc21f5f269a984b2b70ab3458acbac4ad82a0385a212c7836b6449

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
541KB

MD5
50664f6b0940032df1c283e25df61eef

SHA1
091b135f148d8e3270d80382f4b3584e8bbd81f9

SHA256
5c6143165c46a3833eeb039c587468abb90a1ef6d37451dfb29c078cf4e3d99c

SHA512
1643639be2735e1b71c8cead5b95eb3d336011a9d54fecf7ea81fbcacc06fe5e33c08b0f19c6ad50002faa7a26441ddd0956036574a2de37f3739e12298c8242

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
203KB

MD5
d4204f135cf940e7348d905f8edea03c

SHA1
9210e9346cf02bf37c41b422c924a5ce8a085fa3

SHA256
04e9e83c6527ff6d5ab990b0f1d767ee9a2f1c4cc9c5e4427ae12d596f3f416c

SHA512
193c8a206a3b6d0281aeb03f400440c50a3ef315bba2e4ded7b777a853dcc4f3e4845723c4332ad80c65180650a8fe6b1dd0d889b8437a4ee338130bff1a69d6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
108KB

MD5
5516587031f1f84cb6653a398b52b7cf

SHA1
bb695b9228106f629d903ceb7267d850a5afab9b

SHA256
9bbbe2d574c45e07e34f9fddef21a5133ae7d3f878daac11ec24109c999b7302

SHA512
3c42d5979cc62116e0b84bf759a515cb993cedebbb48595f04d719e448e69926d8d75b84eaade93e336d8c833b1d1d6b47e7446eaf678353a4adeed1f38f50dd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
64KB

MD5
b912b4d022b39d517fc3eefd786db752

SHA1
4802e6a1584303523891e1a141e9ec640f44ab06

SHA256
106f0465beacd571a3de6a7241c4c9bc52b2f4cfeb503865e548e397ea8ebf55

SHA512
fb37e2e91a7a532e564c2d8655a0236e95aaddff535f10828a6aefce47e41f78fdcf217acefcaa0d94593722aa87b10e4372ba0473fd1253213fe9564371459e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
64KB

MD5
1b60e7dcea78004a71c0e090e18ed799

SHA1
eec0052232aa2a66b9aa78401b0d94074359354d

SHA256
36cdc9431db68da3ea3936f7848b567d2a1c41a2691c878acf97251a96cb2064

SHA512
153edf94b2f5636b4ed45fe27db5a90ce888358e92f46f261ac46b2ba6c7ed5faed2cc8c0b00353e062bc4116ca258d8acea9c2162c995c1e75887dc7c8584be

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
201KB

MD5
a63e037b6988481378b98debff7c686c

SHA1
b8ee1a066231ed0c15cc78f75cd9ae3bc5f4ffdb

SHA256
3b39b8edb2143b3a3ff185d745943a166caddb7700c81d83471ed1ff22dd9f98

SHA512
d1cd8372d033be597fcc302a0b60ccfcb132400a9d0c81c9c31cde64c079751e5250fca35d49bbfdf866a789a389143492f02445937595ab8d6dbff23f47a8c7

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
83KB

MD5
9f0227d1a964984f28295fb6f05263c9

SHA1
203d925b4286c984d170a407081aec59e055a0e9

SHA256
ec1b44cbd4a4386c25c07647b784983d504ec1a2990c130e4aa484898ff5189a

SHA512
f710dffcc669f0423d35fc2b5913efa0b14444416ada234af7cf2260c28f3fec2097162428d7dd1fd5613e89cd0fd8df57754a29c5727a5e627006661872521e

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
19KB

MD5
7902e987a99c7d53ad8d962f4f154ee4

SHA1
b3496385b0fca2ac102a8275e78770ae51359055

SHA256
8343c27ad42088cbff286ca49fc4208f3f5350ae4acc49346515b8df3093c7f7

SHA512
395b9980c75d10cf3fdc476dfb0adaf882df12a812c3d1a3db3505aa1ab3d9314b90ffe96cd242d8de3cb3154176fc3f5d99b6e25f2ca4eee32e115720941295

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
266KB

MD5
6ac8c96b3ae045ab0a40acce49915036

SHA1
f51d2760ea194700b086d4292bc89daaf77a2717

SHA256
b05796a648dd7222e69499e7bdb77304e2e53f16a463f0c39b69e20de4ba2077

SHA512
3e6b65a14ac52c8134000cd7b7b7510caa3533911a867a14c4b592455568f8393d9e448756bf92f5a10c787529795b6f718ad6a5d15b606716a93f37023c48f0

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
137KB

MD5
5bccbb3b1b6fc85b6329595def9e858a

SHA1
65129be6fa032b86222a08a38955e92e6b67c54d

SHA256
d11233d90ed343fadb2bfae75f59a33998da0c32cf1e11f3af9d40f6a1f86ffb

SHA512
6e8f56a0745eddc55de1dba190f4b756a7a246c2e04759cb8510a9767ccaf51b76615d6ca75a1a7d6a521ad2ca4fc5431a988612c2d2c00e5b26db8ce69853b3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
8KB

MD5
5b53b9ce6f1b6f0f7c1b806f805f3f2a

SHA1
45926f3cd37524a495eeeb6efc8eb0807ed1dc16

SHA256
802cd800084475164642e7436dd9da2801a7e62ba72f98c0160a6e6e789d12c7

SHA512
e269e1ecf80d1935612620aea43b27054c87b797438b5656a7e2e6c13e9aac1827a53d98344d95441ecfa768b71d63555da505fa55db015adee62fd34c621aa3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
127KB

MD5
a24503458bd989662657bce4eaf57254

SHA1
a67549d64d5c8c7bf3c528fd156e5e2df3106baf

SHA256
89c6bf790f7a12c90c62f63b1915a88b81d6fe4ac5c5db71c8f98068ede94722

SHA512
c2ada656493bf2769751bb372f4c9f20dcfe706642c1a62ca226480942a55909c87cf87b2b879a443d2305402bbcdb644d6835001e8e692f9a0d6571c68c2325

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
48KB

MD5
e6ace68207963f2059062dee8cca17ed

SHA1
4ef38636c4b01f29f0818d6815a771c999228c61

SHA256
0cfebbabafb25aa0ccd135b7ae47d503e516b35918cd0b86c88e37f252110a9e

SHA512
3fdaad3cdfafd0e841562f09700bf053480986a2277c5ee1f80363e5d531ec27076165f76bc813ae8f2d025860c666665c9c163f1fb7f304948603259e00e176

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
7KB

MD5
83cc94cc9d185f0fcf8555c416235e8a

SHA1
547cde6f385edd9ea0c64854af79baf9d4195e60

SHA256
79e79f6b6670d6793bc016fada9ff22b8b92203a031c3660aefd471a1d1cb74e

SHA512
2f116a65fa560c36196252520807e34517eec8bb296324627246c580980683be7670339101637c9a78321d3ecdc1d65e0c201165a146d3f16e5298b2c2cd892d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
59KB

MD5
6e95eaa7b12b089a1ea3f157b212cc90

SHA1
1974b16e6c496da1ad6a4b2dcbd4ab14ab5e60ad

SHA256
43af9d1cdded9547ad7e099207d4e778ef30007120fcf69f2cbe2ab7b04d69d8

SHA512
962ba244655f32a3f44b67d2ee6972b12deca77bda4dfb64b98757f4c26e0d9f1987dfac0d5905a086045e473b4cd41a25f00b3aeae3fdd49e874aa7bfbdfda9

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
47KB

MD5
7657ab4b664507a29280cdb6a766f363

SHA1
b108b82a6b6f315b67551ff1f38c084ca44b3856

SHA256
59ba6ccd315e5f3424834ebac0608762b88a68e9798e8b13db155bb6a9256f50

SHA512
d9ecf7188c5f53697a2e78ae32b244cd912dd4e7c5cd434a286ea2a302b30cb5a1ee96fd5859402c6222e86c98d101bb136cd8681d9a878b08fcc71e7b69bb04

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
32KB

MD5
d75fcfadbedd4bd22c254d6e7c975409

SHA1
ed978f39c411d9e6cbcac54a4c68fb99d5cf1109

SHA256
702bfd11b4bd86a2f208c00fe4afdbc334dd9454e3fb4ae54a271f09e7a975e8

SHA512
a8485ad2ff8131a86608bb9011b1411cf266c4d4f6d8b6296f6d3b1bd02432548746cdea66bd0989ef1e39e615fbc38d14ef1c6f5c706398e30c51dd12e22e82

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
33KB

MD5
1c667566a5b69623752d300fe1455142

SHA1
f6b9a63a1d3278d4d0851949f13aba6737bff1d1

SHA256
545b1b5a03ccba377982c960721996bd611f162a2056b2429fa4a0048c647ad8

SHA512
b11a3fa7e44cc7e6a12e03e1a6d733579838107a229098e9d4035278d5140ac6e082b466fcbc33b49da17c7f730d368e333deda7741aedd233c2e82c746d9838

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
8KB

MD5
29f6c3aa1c6a52fe9f47bdb33458e701

SHA1
92dcd0ebde9700e5a493a7f9b781b891c654652e

SHA256
097c3dd2fb0889163ac69b7cbc0cbf28c79007c06972120262c008f6a614606a

SHA512
648f9cf2e12691536556f0a00678919b46aad095d7f3edbde3803f5de2dc1425a7804c1ac47ab7fe368216ab36940d60b26e042330b46ea09e637ceda1ef12c8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
77KB

MD5
dc561f94b98a238efdddc40a7d571b95

SHA1
1509f8a6dc9739045f7e22a4bec114f13cb782e1

SHA256
4d65f9b419cca81cba5c1c7c3c9eee22042b3086b331e05635e616f172dd0706

SHA512
60f91e06d1027c22f0d1a58aa10354c397ba280f71aa3d19370d83293ea40802907b7863d3a19ed9f3f3387b28139252292caf0e2fed1a39d9d434b2b3bccaec

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
87KB

MD5
7f02943e5db190651182db749c291ca2

SHA1
1907a3c8816336f28178d90f1a381e5c47707d1a

SHA256
19c2fb8554bc5dea7745289803eed667568b0eb12f11ef6c821420ec9247a669

SHA512
7e7534158523be5e51b58270bb5957389291d54e68f5c2205b857e5f191ff9d85e92caa8e15f1623791bb3694ec4042c1c6d44514a29d1a9db37e95f7362016e

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
21KB

MD5
ec6d9eaa89e09f10c495cfd683092ca1

SHA1
e43b95a7f48717093ca793026edb221cc394a176

SHA256
234613cb3393667b8e1fb448513ee49cd4015e0d14a7353bf4cd300b7df8a75d

SHA512
1c67b3c731b8dd1ba257b20d665a6db85be0237dcdfd01bacb3a89943a349663174626f2726aa792a3af506afe0aefbccdaa30be334a72c917124713e6a2eeea

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
40KB

MD5
53db9062cc7b9a1a2632c3bcfea60a74

SHA1
b5402341a72ce0aa34b2da8d4ce85b3fb2407cf5

SHA256
3d8c332bbe8332c1c28cce1cfa8c90c0028d2c73205f3fa1de5aa3b8211e951f

SHA512
64f6ea920582e691d223100c065f5fbeb6c268a5746801161b554f00049f4d20ae5c9c55488c144f3a3d5f8afec737d8b967a23c825539e77c45de0bc07949f4

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
15KB

MD5
6d034e78b65ee56e248868c83df9dfb1

SHA1
f9f098c2cf89edc3222cd12d043fc3db997b8cf9

SHA256
401d1e6a67b8546424cdb24fc2a518a580351f76679299e6a4294955c8dd4d93

SHA512
7d028390dac932046b565679ab9467da2e3b5454778ef7accda67dfe0cfc9de33e22f606832a29fbe30873f19b928d08d1b3d96b3a2b019fc10b5501bce43b52

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
17KB

MD5
1b060605631d357cf128d4d2142ac0f6

SHA1
f25d4ad170d4b57346d4df60955ea85fb4774fcf

SHA256
4d45dd2488577254c6be86c56850460beedd4e6fdb729a2d54c0f371a3065e53

SHA512
af1425893274fbca30bf11944e2ce22236db1d9e16188f25bf454d5e0c22c72b5b40b86e24ecbf12fabe58e8ae49860f9006e11d4fb9fbf6bf88dff1e6ec0cfe

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
27KB

MD5
01d3d31a7fd629599503188c652a67fc

SHA1
b6dd5b1a0e8cf9c34f09377d1d40014c0e2044ff

SHA256
92fdf11da703d33c60ce7b64b00676f159149dcc9d6a3d2696bfd589f259c237

SHA512
9ac738aa9b3ec2d13abeea78fbfa6e2f8506241b00dc7e87db575d7515518e2100f0fa5bf8d15cdc8c9c6d0a3a9499b2eef75f9ab85611dacc9cc8c50820ae0a

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
56KB

MD5
a26c1c9819d27dbc19e4f7b0d6096353

SHA1
8c6c4d27ee026899ccab491fe580c1adb2ef849c

SHA256
28240e9117a6d75432b7c61797a441a60a040bc62483cf0acaa1565f0be04189

SHA512
49f85fa0b4ecd9a71f614eb91abc025b1024bc82b26e1e06dba541866fcee6ced6d3741857c111a5e44693dec4e77c1f5a34e2ebded1617a499fca926deebbff

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1KB

MD5
f3bd92ba7f519a4dd07a312c63f64da4

SHA1
6f32a356a69e55fd687087b3c8df962f5bdfdb1c

SHA256
f82169c18a4037a9bc13023fa2e0713c53570b494ee42289205e15e5e89f56dc

SHA512
1c56ecf67adf6b305c3a9679e55fb3176fedd7d1be56826df73aa2393be7a8a983bfb356539cec9ea0d53777f57f1ae18a788b16bb2954fcff9c5068c69bb92f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
40KB

MD5
bef40fa48610195084f1ced2e975dd73

SHA1
cdffc57232059cc48790290df85e259b660ccbd6

SHA256
c0c8345d82ce2d4e63a9e72afd6d76584028b4f6f7a00f77414b9f8c8ae3dd68

SHA512
2102284abd0af87f50290f59e2f5c7584feff74534c4b388784facfec865fe6f6df26cb6b8761a3f513bdaf89f4294939f4fae5d964fa07d24e31ded4e0d7466

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
69KB

MD5
886e64432f035be9fbfbf90a883c85cd

SHA1
52704dc269dab69d3fd70e42fdd2afc405e60359

SHA256
5f28928ddceaae88eac6aec2d54fa3673d0c0feeae48c13d663e043f3d72ca59

SHA512
c938399839e2a551f560808ec8eae9712a0b1908cf8adc8f225af68a2d7761473ef2fdfd9db768d8fcb9a2cf2925dba3fdef0ca506395ca5247fe581ff4affd9

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
171KB

MD5
90fd5018bb43a49bd34e9dec3c9c6f47

SHA1
5e862598bc1c20bb7b70692410ea0db29a9ac703

SHA256
63f8f2210f5980ab942fddd0cf37660748de41497dcafe31e1a8ecaf03c65a98

SHA512
5bc49f43d23655bfd6e99de5ce51ffec1d59ba5db19135efdf376c4935f38a03391826d1ed00fc42119b6665c969ccba820051eb67b3cb4aa46275363baeacb9

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
c8473a6f6e6118ab7859429d87bc1b9b

SHA1
e17ea18b03dff682e228826d80e77048a526e863

SHA256
e980b5a277c225c45b23d7157467b42804d1837bed10a05edd2c24599f38e05b

SHA512
21ac385a9b435ad300015468042d46f3a77d8fa66ab9692a8f18d844500d4c68e6f73db054c46e7f5f5b102478aa92a98da5ba6b88b877734af0b8a91bc57663

Download Submit
C:\Windows\System32\alg.exe

Filesize
622KB

MD5
136888ea06bca0f4ef81720d343bc857

SHA1
2fabafacde8325aa20fb26dcc191658fd6340c99

SHA256
3636e47818c110dc4245f54cc43da1667d9878619dbe4054446cba2748707a8c

SHA512
538747109386242adc444cd843199f56e8d3db809c8b0dac7dc815bc7a299c7449e3fe0599e3c001cbaf8cac7220062ce7e01f518e0bc8e8cd4cc530a0b306f1

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
58KB

MD5
a57a21fa1968961f2185483fba5ff371

SHA1
2fafb6a1732b40ee32cbf2a2167685a7b6713987

SHA256
c6d51ae44f240f57b63cb74e9ad2df8e46d614d4c00ee098cc9195d606745f41

SHA512
f8181dac2773dac3bbcb8df6df4e532a28c021764b3f8727b71f6452ab463bd46d33d1fb322e7e95249b1cbdf24b7a5435d7c734bfbaf78d9098fc520b6e8f62

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1KB

MD5
5e53be5ee7621ee772d42c78306247c6

SHA1
84b993effaf814db71c4bb6bbd23832b8b374f78

SHA256
e86f8cd1446a3339dda5bc009cb660a8c56c5f571f03954bfd0b6ca6601cb432

SHA512
50f5d2db3a21df69175eec357dd98ff540439013dabf9ebda8abc561dbb9852e5d5f27dc475a8bebe842142c4c300c9de3358b2e7ee9d137f781f9832a2a5d14

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
92KB

MD5
512f494eafa35c8b35c4cc50e7bf7b90

SHA1
9e455970cb548965f1196b832d4ddca0353deaaf

SHA256
efd635041a81f6fcce39e8aad227c7cc2b7995610321afcecdbd2e7b85108173

SHA512
482b92db52b904a70dca6142a573f81cc6a7644e0eb9f3016201be4fc2b48f0df1679bb3dc97c2a87bbd4ef1024a6e2d0dca8bf3fe86625c5630cdc5a037d660

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
122KB

MD5
5da05715ac42061673ebfecb5a15593e

SHA1
c8539399c53bf3747ece25747555e0b691ba2742

SHA256
c95b200125e84a4548f2f6e39a6c50501073483ced2764d235bcacee2fa83a26

SHA512
ea96923061a837cf3a5d9cb1a840c74d148cfc463e390856e6bd83bcbaa230888efcb77a9ffd1c652e0d1dfc0d422c53b7095125730975b2b87e364a025c3ad1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
92KB

MD5
4876b4c2ab003e06537a7c6110ec8a03

SHA1
dd8b680485f289bda0542aee0b6ef6421d8f5553

SHA256
c50fefe0048ec74bc2d9ac1662cde560385dcb881d959f28df15c06e60675696

SHA512
f99cda0c23c5619dcbedb70aa530786198cfd2b4aa080535b25c4e4b0573f6a532a9f6c37a59bf5bf11fc386616a8e36eb4925d6647039a5253351b526a82f4e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
65KB

MD5
e650587c82e7222d094bca29622dcf29

SHA1
c4245060fd4b8c990ea522469531384d7d9f7d99

SHA256
2d15595cae3d3f9074ed4386bbcbeb98d705edafd5d236974417cb34f7a99adb

SHA512
85794adc3be8c366eedb6284c42c903d6e88d262b8bcb3471400be927c0d53108168432b018db8be30218ee921f1f6c2c9a48610d1d45dd7d6d82cc858a706c3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

Filesize
45KB

MD5
6bcfc0a028571f0eb79b4ae097acdf1b

SHA1
3c9c0f71f8ae3565fc9755043dc300897755df03

SHA256
fa95b932aae3af9b3aafbe16e4802b105565ea444a0fc6031899f37dd6ae0572

SHA512
c41ac7dc6520c30ba493149a071210700644ae5ded77f17e7d30c2497c56bfc9e120dd14e34aab3513d817db40ec2b555453b120cf8a8216127f0b53a399dab7

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
34KB

MD5
c26b034a8d6ab845b41ed6e8a8d6001d

SHA1
3a55774cf22d3244d30f9eb5e26c0a6792a3e493

SHA256
620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

SHA512
483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
26KB

MD5
c4859697f6d18133d81225f976a185a8

SHA1
430b16280981f43646d8cf1ea77612ce5c6dea7e

SHA256
2bdeeadd60e27e604d6dcfda13e40b6ef42b4053fbf28f7d54a79b9f39577544

SHA512
c0e19ad25c40e4ffef2fa6011e69553fc038b86c7a933ee12fd53382a4271f3cfbc1856bcdb7ae61667413721094a2dcb94597dfe7fbe8ff1e4640631729712b

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\1f5d757f0db1005daa2dee10d6117655\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
19KB

MD5
a94fa9cc0d335d9745c22bf9405cb9c5

SHA1
e2f26e6014ac01dc088675ce1e7aa5253c665932

SHA256
50b7da6a8a8cfa18b9e1228fb69d604fd29312d91d52e5a22b8d69095a9c1246

SHA512
60d9dcc6c804de0f2bdf020e87911ab112596c4b319e568c88c33754cbd5a99ddf244ad7dca853d78423bf87d0be6848cb0bbb02be5f50a809decf23755a0657

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Filesize
41KB

MD5
3c269caf88ccaf71660d8dc6c56f4873

SHA1
f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

SHA256
de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

SHA512
bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Filesize
129KB

MD5
ee84adfde189c0c4569ccae3293d73d5

SHA1
0328309cd3ae5102402876f5d01135cb63e7edb0

SHA256
4d11f8f49ae3680d585874366fec0c529290996fea7225f8f2b38b2a421eb9cc

SHA512
7e8add8be013d2243d620be11eac0ffe6f4ae44368156fbb84fc7caf4ec712c503c469b91fcbff6f6cb7e0a5829d909e9fa5fb0a03be58d5696f03a8fb35f431

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll

Filesize
285KB

MD5
78bcb02003b5abf39db778803dff6f9f

SHA1
45941c35e0ba1c8a21b3878c403df5298050f620

SHA256
7ae3c043ff9a7c22d37c68c6c9c52f17e8e36c49ca97186088a085c2b87b182a

SHA512
100b16f392c8761e71607ef4a7f8c4ca1ec4ff49f4d34ae0c7e67cbf30fb518298e00a583b09cfffbd858c87a01e157f6ab90c20ec9ca4377b6f1c05831caafc

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Filesize
109KB

MD5
45c5dc1e52d4b8a6015947feaac6dc3d

SHA1
1216ccf2151cee69351e75686ea3e308a2ca554e

SHA256
895d861b8949a68df16a498a8a4f08a831f331438929231d56a575d0c40ff634

SHA512
3e0782a4284a861623664ec0dbefc982cfe1ee96c5975cc8d8be73e9ce60d454f16ed43165abeb342ea4e69c8dd21e8d230593d4017754180defb6db69c3ec82

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\88286211fa5759ff92c328720622e8b8\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
83KB

MD5
1b7a47af595454f9d55f25e1e3849c07

SHA1
3487659586ef06b78ee2637333547430f2be74fb

SHA256
d47c0fec7fb5bf65a3a9d949fb8f2e3076b65c4d583f539853c642c06367f6cf

SHA512
886f6bf62143c017ef7ccd846b03d2931e41a1507f863165066cc40aee60e53ceeb3e58e9a883019bf6113406caaba181dc282f313cd320bda6dff034ad7a2f0

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
38KB

MD5
52327a17417557ddbf0072bb5707d329

SHA1
84c307e99568a13bcaa87e017317442136c54a16

SHA256
1bbb5d5bb4a7e00610a5dc186e1aafac7611e8647002af01622cb00cbac1b4db

SHA512
62cd73cb38a98f3fa994e4d1b328c1cbcbfddea3b85bae563de441cde072521d253a604dd9585b0ff5c3fb4e8e18c11de0e054b48cc202896d18c2a59fb309dc

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Filesize
53KB

MD5
e3a7a2b65afd8ab8b154fdc7897595c3

SHA1
b21eefd6e23231470b5cf0bd0d7363879a2ed228

SHA256
e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

SHA512
6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Filesize
65KB

MD5
da9f9a01a99bd98104b19a95eeef256c

SHA1
272071d5bbc0c234bc2f63dfcd5a90f83079bbab

SHA256
b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d

SHA512
dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
28KB

MD5
aefc3f3c8e7499bad4d05284e8abd16c

SHA1
7ab718bde7fdb2d878d8725dc843cfeba44a71f7

SHA256
4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

SHA512
1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll

Filesize
21KB

MD5
8b923bb83010f5fdb2633c77243e87f1

SHA1
375880122837a4a9057a5ffaec3ff58012ffc32e

SHA256
c5636ce8c315810fd5e5ea47f60477189813e2d9f8538c11d36ff69edaa2a067

SHA512
a35a42de618b1e2e026ff0b8e4c74bba19be99d713b21376a5ac8b0cbdc327572c05c6830868ecfe4a8efc2a79e1e96d834ff4151abb8599f6424fefd3d8d302

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Filesize
79KB

MD5
dfe87c0b8b4d5e84d4ce543c089478f2

SHA1
de93abec9e0ed20bc613889e3992590b27b57fdb

SHA256
48f6fccc704d1c55617dad5e399337d8cde5d061fdc88306166d065b3c455cc0

SHA512
480f2a345950c43d9cb855a0aa3270074ed20bae38bb753988a4e1d445b3ab4547b3603fde0987914abaaa27b8b51a415bf03e3fabeb846b8f4687dec756dddc

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\dd417724ac0ff60d4a597fd334f2509c\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
29KB

MD5
18af4740b986c7cdb32f8c8351524ac4

SHA1
1fdaafc6854c71c2842f7a7478d4f256d08059c7

SHA256
0007ed8adb9b72d23838aadb9c182f19a3540b15a4498b27c29ce9e0d8ad82a5

SHA512
ab18673d973e22d16b87d00af14f3bc542c265d365abcc8cc105b5096093a2a08561c24646d470c82bfba73eb8f87517aa58afd63a1ddc02d7f0e8971396cee4

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
27KB

MD5
9c60454398ce4bce7a52cbda4a45d364

SHA1
da1e5de264a6f6051b332f8f32fa876d297bf620

SHA256
edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

SHA512
533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
1KB

MD5
8385c153fab5e290f4749e68c1633b2e

SHA1
d392e50a1d4cc5f06b2d895f407d199eb920ccbf

SHA256
bf17638f9dd03bb5162856ecb1ff1deb3768fb307b3a47e1724b517662ab5fbd

SHA512
f6e9d89dc1d834f2bdbf2c83aad12d0b9f4f6229c3c8448d3e4af59fe29de1a5ca0a95803022fb38427254b74da6bd7506a93e85d2bc9457d92e8afcac5956a7

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
130KB

MD5
2735d2ab103beb0f7c1fbd6971838274

SHA1
6063646bc072546798bf8bf347425834f2bfad71

SHA256
f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

SHA512
fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f0372e467f256006bb9f2c9428443b9e\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
37KB

MD5
610773f82a17f63b3ae4514b3ba72743

SHA1
86f526fd80b0f2dd1f269c8d7666842e6aa3c592

SHA256
f57f8668a24faea3998a56fc7056f4018cb8392fa296ce4cb692d8b4360d8966

SHA512
7bbe3a2bf1ce2c911a762595b6b47de914a9a0f67771a86f85c7f756f041aa559f35b10e6aaa8b52fa8e78bd76816aff87f9782b0d5b80d26609551c1b9adb23

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
59KB

MD5
8c69bbdfbc8cc3fa3fa5edcd79901e94

SHA1
b8028f0f557692221d5c0160ec6ce414b2bdf19b

SHA256
a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

SHA512
825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Filesize
42KB

MD5
71d4273e5b77cf01239a5d4f29e064fc

SHA1
e8876dea4e4c4c099e27234742016be3c80d8b62

SHA256
f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

SHA512
41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll

Filesize
184KB

MD5
e5bd004a910f7247a8819af96c986036

SHA1
bddce9f90a17b5000ac672a40352b1dfdfe343c3

SHA256
92a6c58fc88eae0b5b7cdd218bad3f0d8935b7c5ad1163c952bc30d21785e482

SHA512
4be24d100f807b7626e153740d707c1e42e889e17ee513e237babd51ba265de30068abe605819692ec3c0a09f21bb3590be7756ea783846addd19d7f87c6b800

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll

Filesize
43KB

MD5
3e72bdd0663c5b2bcd530f74139c83e3

SHA1
66069bcac0207512b9e07320f4fa5934650677d2

SHA256
6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

SHA512
b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

Download Submit
C:\Windows\ehome\ehRecvr.exe

Filesize
138KB

MD5
90c2b4ccff25e6d69ab4e11ef6ea353b

SHA1
3a975b447cb8b3567715e22cbffaebcdfebdd0fe

SHA256
4a04818a3a476f9607488eca9cb8b47ef873cf6b65510d6242b09626a1701d4f

SHA512
578412135f8fad120b79585028070d8773f33dc0d8f128a295c30c7f2c3ea24ac9d6edfc12c4d4f70b3bd3789e65830884c337342305e143955c4611269ad47d

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
122KB

MD5
6579744346ef3949ec33009670e5b1f2

SHA1
4ea1777d62f9c1fe7f01f28b9c465e731856494c

SHA256
ed0b8cc235d0ffd4f7e69276184fa3c0b65d612d6c825d1da4c9cbac26100a0e

SHA512
15bb1686da6954baa2936f0878d1bab879bb6ec9a53345e59f8dac55365c48610836ac7fe2db81279df01364769ebbae373ddc36c28a4f808a2951f0b10470b0

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
167KB

MD5
4fe1c1184e2cd92c84cbc28cf491a9ac

SHA1
77347399c00429a82aab947e95884010c2c67223

SHA256
c5e205fd454a0e02f3146218992f9534fa484d4077449e31335f23316d7e9b8a

SHA512
9327fe605d47800d5fda5b19513805a0a5f1b88e2c3016b17c9211d1a9ad2eda7c818c4cb292cc931b6368f8a17a7cb54ff27ee7b4082a386f4ed1a1db13ec3a

Download Submit
C:\Windows\system32\IEEtwCollector.exe

Filesize
100KB

MD5
490f3749f176a5d5d3f9ad0d10236834

SHA1
a994f461187e75966c71885b7e17bcfde653ca83

SHA256
baa6c0d1c1c175a1bd20d6036eefe1ab471d3fb65cc54dead40f9439cc4a778c

SHA512
e5f0047f755f7617b0ae9ec76d6b6b0479778e8f0b29016c0d342ab7252cc13050a849e7c4cc028487328e477b16b1b374a82702919bce18024b50b5da43ccd7

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
80KB

MD5
b437e08040c6fd0aba95c39d611f87bd

SHA1
00cba60af7ed451d29380c931eaadafd5f38ccad

SHA256
7e080d632cfecf95d62720cbcd485b0f11e9a761a1de45f5552c01e45f62e8b4

SHA512
35f55506b672bf5742f20e1cf528dccbfbf954d7f69d1b20aed1beb3fd15fcb61bcaa116b32f0e9ac612f500c1281cef80d65e238da087afdf4759e858f48707

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
63KB

MD5
50bb972342ac666f1be7c7a93b26b89f

SHA1
174389d675b8fbb1f268bb5d31ad0792530b734f

SHA256
7d1999bf6a66c6551b6bad4368ed865f37b2ac0894751dc5ae7bf88fa9ddbbde

SHA512
5ef4b344750fcf49e6926bbe0dd8f3e1b52221d2e7580f3778ff335650407cbd91dd247c41e7f17b36b2e88fef1984d897d25a3e7dfc6ecf66f951aa08d7fab3

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
448KB

MD5
cc54cb81e74ada751c79babd7006149b

SHA1
9d6afd6a5d51b2919134ec3a3f24368907251020

SHA256
df3a141100bcf7424529cbd54c4bc84e5965766b8b534311ea598f32287db417

SHA512
8059f927047be1f7f1ba4cdc92e71c49866c892e8d37410c9605944f9f0b484ed3b3809a03966515bd1cb5cd136ca22ffdbc7aadacb39e4a6db23e9c165c2bf4

Download Submit
\Windows\System32\alg.exe

Filesize
807KB

MD5
29817549c11c17e0dc03fcb4512495bb

SHA1
2ce381a10392956a0bbb2bb85f9a7db186f508b1

SHA256
43bd4a65c0a76926802e179c0e41cff587eaa1ba32cbcdcb3818696c8ca2b93b

SHA512
b30af7fb270bb7b7d70aa94af3e96fe4dcfcd591281d802f6328211e419c1ec175cb6a9085272ca869011ae022024d89275e6c7da5acc65864b54006a27ca389

Download Submit
\Windows\System32\dllhost.exe

Filesize
26KB

MD5
466c07001ceaa1aaf182a1906def093a

SHA1
68a9880cdd457b0a6d76e2b5283007568948dfd0

SHA256
75fd0808d7acb2bdaf214a337f2dd6f1ea68e9a25897fe955659b3847e4f0564

SHA512
637b38bdc65de8cae21fea466791b119ca82ec61db551f0eecfdfbdb91b90dd4c8d8ddb14c83760980dd7b8be4fd95d05526d4b3d95548595cfdd1674457ce24

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
12KB

MD5
f4ffa7cd96796c344a04c499a81b2caf

SHA1
f292fee7a4280a8f0048abe89140f624fc759afd

SHA256
1ad9d1b491f94e08603ed0867c234da60947e195d870d30838a316b3ac60794b

SHA512
1988215a9267fef897b30840b235e17278b381d1667044a60ef624b31a8e9731c04b811bb42d5122a1e7ce15f77ccbe3a6d27483ef71f0b7122928aee1b7cad1

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
27KB

MD5
f4d685a1938bfc339cd5fc8dd5cb1213

SHA1
0e832422f3f4de433884568795de15d155dd83ae

SHA256
cbc35e06490482dc9b66327cc019f5e5337694e3d9a6045a10bc86eed6b2cb87

SHA512
6aef608626bfcf290ad4ffe727ee59999e65ff49cfe37f834f51ae12c0ff3290333098ad7e9cc19702dc0e876074929aea6cefe3ec64a310148b171ee0229299

Download Submit
\Windows\ehome\ehsched.exe

Filesize
142KB

MD5
fcc54dae17b71e7d7df563430bba3da8

SHA1
daee71676e06c541442a09185e1c9bfc0d5c81ec

SHA256
21238358a8d5756331e88aa1a2040226fc70f207cb5d939aac0f984bfeed3ede

SHA512
815b2972b335ee666f61199a15c44d3c1f255259e83c7722a1778f8a086f0d32d9d8f64ccb8e1ed0c62fb39fad53a7dbd419196c2476dd2e7a585cb66f73b742

Download Submit
memory/760-140-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/760-295-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/760-0-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/760-3-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/760-6-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/780-338-0x0000000140000000-0x00000001401AB000-memory.dmp

Filesize
1.7MB

Download
memory/780-339-0x00000000009E0000-0x0000000000A40000-memory.dmp

Filesize
384KB

Download
memory/780-331-0x00000000009E0000-0x0000000000A40000-memory.dmp

Filesize
384KB

Download
memory/780-324-0x0000000140000000-0x00000001401AB000-memory.dmp

Filesize
1.7MB

Download
memory/872-112-0x0000000010000000-0x0000000010188000-memory.dmp

Filesize
1.5MB

Download
memory/872-138-0x0000000010000000-0x0000000010188000-memory.dmp

Filesize
1.5MB

Download
memory/952-206-0x0000000000E50000-0x0000000000ED0000-memory.dmp

Filesize
512KB

Download
memory/952-218-0x0000000000E50000-0x0000000000ED0000-memory.dmp

Filesize
512KB

Download
memory/952-211-0x000007FEF4060000-0x000007FEF49FD000-memory.dmp

Filesize
9.6MB

Download
memory/952-204-0x000007FEF4060000-0x000007FEF49FD000-memory.dmp

Filesize
9.6MB

Download
memory/952-364-0x0000000000E50000-0x0000000000ED0000-memory.dmp

Filesize
512KB

Download
memory/952-330-0x000007FEF4060000-0x000007FEF49FD000-memory.dmp

Filesize
9.6MB

Download
memory/952-341-0x0000000000E50000-0x0000000000ED0000-memory.dmp

Filesize
512KB

Download
memory/952-441-0x0000000000E50000-0x0000000000ED0000-memory.dmp

Filesize
512KB

Download
memory/952-347-0x000007FEF4060000-0x000007FEF49FD000-memory.dmp

Filesize
9.6MB

Download
memory/1264-307-0x0000000140000000-0x0000000140192000-memory.dmp

Filesize
1.6MB

Download
memory/1264-176-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/1264-177-0x0000000140000000-0x0000000140192000-memory.dmp

Filesize
1.6MB

Download
memory/1264-184-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/1388-351-0x0000000000470000-0x00000000004D7000-memory.dmp

Filesize
412KB

Download
memory/1388-349-0x000000002E000000-0x000000002E196000-memory.dmp

Filesize
1.6MB

Download
memory/1388-462-0x000000002E000000-0x000000002E196000-memory.dmp

Filesize
1.6MB

Download
memory/1756-199-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1756-124-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1756-125-0x0000000000270000-0x00000000002D7000-memory.dmp

Filesize
412KB

Download
memory/1756-130-0x0000000000270000-0x00000000002D7000-memory.dmp

Filesize
412KB

Download
memory/1768-158-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1768-167-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1768-160-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1768-171-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/1768-170-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/1768-175-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/1768-292-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1924-344-0x0000000140000000-0x000000014018F000-memory.dmp

Filesize
1.6MB

Download
memory/1924-214-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download
memory/1924-208-0x0000000140000000-0x000000014018F000-memory.dmp

Filesize
1.6MB

Download
memory/2112-378-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2112-303-0x0000000000560000-0x00000000005C7000-memory.dmp

Filesize
412KB

Download
memory/2112-302-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2148-196-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2148-190-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2148-189-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2148-321-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2200-174-0x0000000140000000-0x000000014017D000-memory.dmp

Filesize
1.5MB

Download
memory/2200-93-0x0000000140000000-0x000000014017D000-memory.dmp

Filesize
1.5MB

Download
memory/2308-159-0x0000000100000000-0x0000000100184000-memory.dmp

Filesize
1.5MB

Download
memory/2308-27-0x0000000100000000-0x0000000100184000-memory.dmp

Filesize
1.5MB

Download
memory/2308-26-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2308-54-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2416-488-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/2416-432-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/2416-443-0x0000000000BB0000-0x0000000000C17000-memory.dmp

Filesize
412KB

Download
memory/2416-475-0x0000000072830000-0x0000000072F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-490-0x0000000072830000-0x0000000072F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-495-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/2580-309-0x0000000100000000-0x0000000100175000-memory.dmp

Filesize
1.5MB

Download
memory/2580-317-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2580-427-0x0000000100000000-0x0000000100175000-memory.dmp

Filesize
1.5MB

Download
memory/2848-149-0x0000000000640000-0x00000000006A0000-memory.dmp

Filesize
384KB

Download
memory/2848-142-0x0000000140000000-0x000000014018E000-memory.dmp

Filesize
1.6MB

Download
memory/2848-213-0x0000000140000000-0x000000014018E000-memory.dmp

Filesize
1.6MB

Download
memory/2848-141-0x0000000000640000-0x00000000006A0000-memory.dmp

Filesize
384KB

Download
memory/2872-96-0x0000000010000000-0x0000000010180000-memory.dmp

Filesize
1.5MB

Download
memory/2872-119-0x0000000010000000-0x0000000010180000-memory.dmp

Filesize
1.5MB

Download
memory/2872-102-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Filesize
412KB

Download
memory/2872-97-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Filesize
412KB

Download
memory/2980-380-0x0000000073DC8000-0x0000000073DDD000-memory.dmp

Filesize
84KB

Download
memory/2980-489-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2980-368-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2980-365-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2980-358-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/3008-480-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/3008-493-0x0000000072830000-0x0000000072F1E000-memory.dmp

Filesize
6.9MB

Download
memory/3008-486-0x0000000000670000-0x00000000006D7000-memory.dmp

Filesize
412KB

Download