Overview

overview

7

Static

static

3

2024-04-28...re.exe

windows7-x64

7

2024-04-28...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 12:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-28_de61684a183bdbcbd90114d81edab03d_bkransomware.exe

  • Size

    712KB

  • MD5

    de61684a183bdbcbd90114d81edab03d

  • SHA1

    924913c0b54c1acbb9bd06d15a5003617e344c30

  • SHA256

    6f3956ec48fef99afdc662515a432fc0a2c59c938c733269c61af5840575a38a

  • SHA512

    6c30ae3751a3810c1604bb95f81d51b4cc13a2ccb4142e58c9148355bad79547111772557504642ff646304760aabdfc294e68eb058f4e7d344ef6575040010d

  • SSDEEP

    12288:ltOw6BaV/bxXyGH7XR2CAwEQki1I7wwY8DMkw5V7iP3sOZ9jDH3kTKE/aoJut8od:P6BgF3B7zPkcowwtdwKzDXkDNJ4D2k

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 59 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_de61684a183bdbcbd90114d81edab03d_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_de61684a183bdbcbd90114d81edab03d_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1760
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2936
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2676
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2600
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2456
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1376
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1312
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 248 -NGENProcess 24c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1912
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 248 -NGENProcess 1d4 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2664
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 264 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 1d4 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2080
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 268 -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1208
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 254 -NGENProcess 1d4 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 274 -NGENProcess 240 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 274 -NGENProcess 254 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2232
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 270 -NGENProcess 240 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2176
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 268 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2320
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 274 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2468
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 27c -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2240
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 278 -NGENProcess 290 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:320
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1d4 -NGENProcess 268 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 28c -NGENProcess 298 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1400
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 240 -NGENProcess 268 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2576
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 29c -NGENProcess 1d4 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a4 -NGENProcess 298 -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2400
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2a8 -NGENProcess 290 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 268 -NGENProcess 1d4 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2848
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:280
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:668
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:680
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 20c -NGENProcess 1e4 -Pipe 200 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2136
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 258 -NGENProcess 240 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:748
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 258 -NGENProcess 20c -Pipe 230 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2576
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 250 -NGENProcess 240 -Pipe 22c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2312
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 264 -NGENProcess 1b0 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1852
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 240 -NGENProcess 1b0 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1956
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 270 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:3028
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 264 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:616
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 278 -NGENProcess 1b0 -Pipe 20c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2596
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1b0 -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1696
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 280 -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1852
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 264 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1968
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 288 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2148
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 270 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
        PID:1608
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 290 -NGENProcess 278 -Pipe 1b0 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:912
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 278 -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"
        2⤵
          PID:2388
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 298 -NGENProcess 280 -Pipe 264 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2672
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 280 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
          2⤵
            PID:2136
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a0 -NGENProcess 1e4 -Pipe 278 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1268
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 1e4 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process"
            2⤵
              PID:1376
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 2a8 -NGENProcess 298 -Pipe 210 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:940
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 298 -NGENProcess 2a0 -Pipe 270 -Comment "NGen Worker Process"
              2⤵
                PID:1348
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2b0 -NGENProcess 288 -Pipe 280 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:476
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 288 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
                2⤵
                  PID:3032
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2b8 -NGENProcess 2a0 -Pipe 1e4 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2464
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2a0 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
                  2⤵
                    PID:2736
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 2a8 -Pipe 298 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:1324
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 258 -NGENProcess 2b8 -Pipe 2c0 -Comment "NGen Worker Process"
                    2⤵
                      PID:2252
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2cc -NGENProcess 2b0 -Pipe 2c8 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:936
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b0 -NGENProcess 2c4 -Pipe 2a4 -Comment "NGen Worker Process"
                      2⤵
                        PID:2564
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d4 -NGENProcess 2b8 -Pipe 2a0 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:2148
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2b8 -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
                        2⤵
                          PID:912
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 258 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2580
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
                          2⤵
                            PID:904
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b0 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:756
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:1712
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2b8 -Comment "NGen Worker Process"
                            2⤵
                              PID:2216
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 29c -Comment "NGen Worker Process"
                              2⤵
                                PID:2104
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2296
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1608
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2052
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e8 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1980
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f4 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2804
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 308 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:328
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 304 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1864
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f8 -NGENProcess 30c -Pipe 2fc -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2336
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 314 -NGENProcess 2ec -Pipe 288 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1948
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2520
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 30c -Pipe 310 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2052
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2ec -Pipe 308 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:820
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2e8 -Pipe 300 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:2332
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 30c -Pipe 2f8 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2192
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2ec -Pipe 314 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:3028
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2e8 -Pipe 318 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2276
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 30c -Pipe 31c -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2564
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2ec -Pipe 320 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2652
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2e8 -Pipe 324 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2196
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 30c -Pipe 328 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:824
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2ec -Pipe 32c -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1932
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2e8 -Pipe 330 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:240
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 30c -Pipe 334 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1648
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 33c -NGENProcess 2ec -Pipe 2cc -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:1208
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 338 -NGENProcess 1f8 -Pipe 2e8 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:936
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 350 -NGENProcess 30c -Pipe 340 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2976
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2ec -Pipe 344 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1324
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 1f8 -Pipe 348 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:1792
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 30c -Pipe 34c -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:904
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 2ec -Pipe 33c -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    PID:2136
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 2ec -NGENProcess 358 -Pipe 1f8 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:1652
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 368 -NGENProcess 30c -Pipe 350 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2276
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2596
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2388
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2800
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 364 -Pipe 360 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2228
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 358 -Pipe 2ec -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1976
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 30c -Pipe 368 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1744
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 364 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2136
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 358 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:2536
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 30c -Pipe 374 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:1944
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 364 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2080
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 388 -NGENProcess 394 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:2252
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 380 -NGENProcess 364 -Pipe 1f4 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2124
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 398 -NGENProcess 390 -Pipe 30c -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:1992
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 394 -Pipe 23c -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:1976
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 364 -Pipe 358 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2688
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 390 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2312
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 394 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2168
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 364 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1944
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 390 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2080
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 394 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2252
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 364 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:3064
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 390 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:904
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 394 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:1668
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 364 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1568
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 390 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:880
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 394 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2536
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 364 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1324
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 390 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:608
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 394 -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2668
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 394 -NGENProcess 3d0 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1808
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3e0 -NGENProcess 390 -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2148
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 390 -NGENProcess 3d8 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1048
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 3e8 -NGENProcess 3d0 -Pipe 3d4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:1608
                                                                                                                                            • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                              C:\Windows\ehome\ehRecvr.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:928
                                                                                                                                            • C:\Windows\ehome\ehsched.exe
                                                                                                                                              C:\Windows\ehome\ehsched.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2136
                                                                                                                                            • C:\Windows\eHome\EhTray.exe
                                                                                                                                              "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                              1⤵
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                              PID:1572
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2212
                                                                                                                                            • C:\Windows\ehome\ehRec.exe
                                                                                                                                              C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                              1⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:2148
                                                                                                                                            • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                              C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:656
                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                              "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2072
                                                                                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1256
                                                                                                                                            • C:\Windows\System32\msdtc.exe
                                                                                                                                              C:\Windows\System32\msdtc.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:1164
                                                                                                                                            • C:\Windows\system32\msiexec.exe
                                                                                                                                              C:\Windows\system32\msiexec.exe /V
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:1752
                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2744
                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                              "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2560
                                                                                                                                            • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                              C:\Windows\SysWow64\perfhost.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2844
                                                                                                                                            • C:\Windows\system32\locator.exe
                                                                                                                                              C:\Windows\system32\locator.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1684
                                                                                                                                            • C:\Windows\System32\snmptrap.exe
                                                                                                                                              C:\Windows\System32\snmptrap.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2456
                                                                                                                                            • C:\Windows\System32\vds.exe
                                                                                                                                              C:\Windows\System32\vds.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1524
                                                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:1300
                                                                                                                                            • C:\Windows\system32\wbengine.exe
                                                                                                                                              "C:\Windows\system32\wbengine.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:372
                                                                                                                                            • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                              C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:620
                                                                                                                                            • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                              "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:964
                                                                                                                                            • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                              C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                              PID:1596
                                                                                                                                              • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                2⤵
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:2216
                                                                                                                                              • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                "C:\Windows\system32\SearchFilterHost.exe" 0 596 600 608 65536 604
                                                                                                                                                2⤵
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:1636
                                                                                                                                              • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:2452
                                                                                                                                            • C:\Windows\system32\dllhost.exe
                                                                                                                                              C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:1820

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                              Filesize

                                                                                                                                              706KB

                                                                                                                                              MD5

                                                                                                                                              b1be46663b4630bc380bb51b2ae0af0e

                                                                                                                                              SHA1

                                                                                                                                              1740b1804c3a6ea9d6e47628e2d7107364fb6a89

                                                                                                                                              SHA256

                                                                                                                                              756014a85522eb25fec326c9cc53f0fff8ab4c8aee7a001e7730828fc7b16c3a

                                                                                                                                              SHA512

                                                                                                                                              0e2539d3cd7ec8ca7a4911136fd657d83eded43f75e5dce45c83bd56729f802cbcd9c02bd951027fb199f323aa9097b9b7a18399777ad8706bf0a4830c69c816

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                              Filesize

                                                                                                                                              30.1MB

                                                                                                                                              MD5

                                                                                                                                              2e8206d25e76676f8bf66b6899b6f872

                                                                                                                                              SHA1

                                                                                                                                              0ff758000443a1b099c102d4ae3a9218978547a8

                                                                                                                                              SHA256

                                                                                                                                              d8c66785845b46f03226ab3d97ea486b9eafe8a3a5b7ee82878198c76a30777d

                                                                                                                                              SHA512

                                                                                                                                              5b5c4f9ae89540ac0a18e8204bd6c8359feb1a3960e7e0e1cfc83b66955714a85bfe53944196895ce29cf34d5da9516e27a9c07d97c88844a590127916968a9b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                              Filesize

                                                                                                                                              781KB

                                                                                                                                              MD5

                                                                                                                                              acffca9eb6a43a93a0a009a477a353e9

                                                                                                                                              SHA1

                                                                                                                                              856138fbe3d25fe1adfd03e1086dec99689606f5

                                                                                                                                              SHA256

                                                                                                                                              7984d67e82b8057af7f7d11cc5b82ded2b2f808310f9020944e605b4cc8b1349

                                                                                                                                              SHA512

                                                                                                                                              6956a0f13e622ae8c79c930b21c762de993364d99692cb1ab03c9cba61d3dd67ee01a9f8d5823bcd03dd0753ac263ab749dfa48621f756c4705ad2d63cefef59

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                              Filesize

                                                                                                                                              5.2MB

                                                                                                                                              MD5

                                                                                                                                              2b8688a085126ffcb612d3c1a32ed692

                                                                                                                                              SHA1

                                                                                                                                              3469c144609521732bbc53659053be4f637edf37

                                                                                                                                              SHA256

                                                                                                                                              71763b03e1ff9e3e16c5650f301ad8b2c649a68a63e1541467f65dd8d968a1a3

                                                                                                                                              SHA512

                                                                                                                                              04c71a511d725b9e53ab39c7bcede143fced3eb4127a8fbc27ff06e7b9df89fe91051171b54adc47e1cba2115aa867772f17e943414ae3c383ceaeb5d812ac23

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              MD5

                                                                                                                                              642f717ffa999f8d3afbb25449cb1f5f

                                                                                                                                              SHA1

                                                                                                                                              f340a16765e7da01a36651867b478b60ac639dd3

                                                                                                                                              SHA256

                                                                                                                                              4b222e955bb4b4d88193c6c5b21a6d3dfe15d72ea72be5ac017d0f17ef81cd2f

                                                                                                                                              SHA512

                                                                                                                                              e38d8f24242a7b521af9645b4d19d38a506d240828f5290327fc06788805e65bc150c2425cafb11c5801a2924db457b1360f23fc926be17662bd6cc10f2fbe2b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              MD5

                                                                                                                                              58782adc44a4c0d6937ebaa3b745557c

                                                                                                                                              SHA1

                                                                                                                                              376dcd8e6ff0d41393d189b4b228234c19b9a36f

                                                                                                                                              SHA256

                                                                                                                                              4fa2d09d0e33673db838bab2505b59aeabcdaf9296cfd1c47b91a252ccd75b5b

                                                                                                                                              SHA512

                                                                                                                                              0d3e3a5c5cd19b31f9010b7020b0b5ba1005c2f3aedeb2574730104f81ac2ff34c14c630821321d5f5e97827b649a405a6454af65ae2c8d2caf7fb22fb9adab8

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                              Filesize

                                                                                                                                              24B

                                                                                                                                              MD5

                                                                                                                                              b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                              SHA1

                                                                                                                                              9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                              SHA256

                                                                                                                                              7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                              SHA512

                                                                                                                                              cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                              Filesize

                                                                                                                                              872KB

                                                                                                                                              MD5

                                                                                                                                              c42c0a82d787ae45bfc469abf13b3718

                                                                                                                                              SHA1

                                                                                                                                              83ef6dbccbdc040d184801263b841c8cf6b7d1c2

                                                                                                                                              SHA256

                                                                                                                                              f64304f09a0feeeaebde14ce3c9ced770f7f3f3fd5375bcd031f492737adb877

                                                                                                                                              SHA512

                                                                                                                                              b747a9c12f10c441c076c7057833b89983664ed13a196807de8e5a6ac73edb58055d51d5a673c3ed90886521f4f27c796a3a88babbdfd5dbd6bd42acc30ee274

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              Filesize

                                                                                                                                              678KB

                                                                                                                                              MD5

                                                                                                                                              1afba085dd76227caa8f4a5c4c401807

                                                                                                                                              SHA1

                                                                                                                                              c3cf8ecda89f6aace4456c192b4876219126125d

                                                                                                                                              SHA256

                                                                                                                                              c0ae7d6fa67028edcac6a63859bd51b725195c45ca340a76a88f5f9ef578c2f5

                                                                                                                                              SHA512

                                                                                                                                              741445f7fa568daecfae138c6d964b398cca517cd22bb9a74a96792ceffcc206dff702c7c713a9910415b090a68491653832d349a25fa0a672aa272a217766a6

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              MD5

                                                                                                                                              8b41c35d7f3087e4acd85156dc88d090

                                                                                                                                              SHA1

                                                                                                                                              6f3320b4daba2176927ea863c9b3a5ac3b586805

                                                                                                                                              SHA256

                                                                                                                                              b2a5a5798a173f8fd6420412f9033107e91e9aea6fd4cd51ebfde3093483e94b

                                                                                                                                              SHA512

                                                                                                                                              0cd32ac25c0605de1e1ea5f67e3dfb84e55dda80018ec9420ded4d1020980ec934810ce6b5bdb39b479b882480a952b6fc7ea38ed69125332fc457e876b9ff9b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                              Filesize

                                                                                                                                              625KB

                                                                                                                                              MD5

                                                                                                                                              4830f0a08d91322272ebbac1e2404509

                                                                                                                                              SHA1

                                                                                                                                              5911a4a378996d728649a8e9cf8a7312c23cc4ec

                                                                                                                                              SHA256

                                                                                                                                              7724af0f3b6fcaab8e48d24124aa0e03ae9c6592bc31e5bf0ac08370eaf51af6

                                                                                                                                              SHA512

                                                                                                                                              c5bbd2f596f37f2c8091158467dd310d42c633bc852bc299ada244d59c23b1cdf797dd7b4fb5b7c46852d135ceb1ed004dfc03330068f9ecfff6b47312577bf1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                              Filesize

                                                                                                                                              1003KB

                                                                                                                                              MD5

                                                                                                                                              1eb7b4b550bd5c09b57f40fab3057c5e

                                                                                                                                              SHA1

                                                                                                                                              a6748e1ad9d3db0062e421da9de91607d8742607

                                                                                                                                              SHA256

                                                                                                                                              d753b48f16bbf7c506a9fd24df5a8c8c5e5606e0069a113c85e862cd10bd89db

                                                                                                                                              SHA512

                                                                                                                                              e93827847e347994a3ccb8ecf210ecb7633e89d8625db8118c274d3ad954cd66b4422363ad4f40488a52325f87cc1a581e26df95ca5cf210b37651f9f16b9e5c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                              Filesize

                                                                                                                                              656KB

                                                                                                                                              MD5

                                                                                                                                              dc926bd7f51ee199e2dcd5a21028008b

                                                                                                                                              SHA1

                                                                                                                                              577a0fc0828b5299e7868c4de714518821773029

                                                                                                                                              SHA256

                                                                                                                                              0ceb76814ad94c6bd92a542555392d7f52bdb9ff16b4aa4b9ab237dd742e252c

                                                                                                                                              SHA512

                                                                                                                                              10d53630effc53acfc292c9c2cf6ab56c037bf3bdbd5fcc0e7af42f38bc4583af94078d9537a94157d42fd85b15fc5ac1ba9ae06167e7d517b859042545858fb

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                              Filesize

                                                                                                                                              587KB

                                                                                                                                              MD5

                                                                                                                                              f80be8b711d23c476ef0dad9f7bbe186

                                                                                                                                              SHA1

                                                                                                                                              4dc12afc7a83fbace8e79888bb2c86c58171e2a2

                                                                                                                                              SHA256

                                                                                                                                              4664d29d7a30161d9b0d3880bd85afa103d211b7cb2f9afc1adbdd281b9564dc

                                                                                                                                              SHA512

                                                                                                                                              3815121e65c5ba50ce9db0425e2e0fa613581ac6ddc175a849103e0bb5d7d7d6ff47c0b9ba6ed84224e7c3c768f1d8f07056094d9b14910c39e0bce6200e4682

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\System32\SearchIndexer.exe
                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              MD5

                                                                                                                                              98608f47db7938cdafb23e435ecf9d66

                                                                                                                                              SHA1

                                                                                                                                              9178052c09a349a0c4b4c7a4d3b839140f601d77

                                                                                                                                              SHA256

                                                                                                                                              d7080e9faa6d4d07894756bc307a56364f8e00c2a1812ec7ba178e928037d69a

                                                                                                                                              SHA512

                                                                                                                                              fd5a198fc4d4934fa9713db8f48e0fb448d0f4720d9e5defeca35852fea9060b7880d0429445b7fdd71148c67ec77cfec3ac1029e6c844f3a71f49f6a58c8fea

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\System32\VSSVC.exe
                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              MD5

                                                                                                                                              52888d9e87d44d72e32611c4a79d9d57

                                                                                                                                              SHA1

                                                                                                                                              bd2af306fa61f439e73f55917350e5dbe62f2240

                                                                                                                                              SHA256

                                                                                                                                              ff5f9f66ee1b5f2e59b1f5616e6794c16fc4762fceaa5787853dbe737972be25

                                                                                                                                              SHA512

                                                                                                                                              8d595568206972698cd6d6fc3917d16d99fcc732071be495725697415b436be614f7fd3e9b07892643886142a827ac4a429eb5812e92348c8d097b35f6ccda02

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\System32\ieetwcollector.exe
                                                                                                                                              Filesize

                                                                                                                                              674KB

                                                                                                                                              MD5

                                                                                                                                              869dfa1864a943ec31a27d3ade327f27

                                                                                                                                              SHA1

                                                                                                                                              d5ad1ed28f301c40d7af574ba05117a42e2a77b4

                                                                                                                                              SHA256

                                                                                                                                              f128c903dc3a814a93e42c465b7ca57b49010d50fff0411c6a6289166676b4c7

                                                                                                                                              SHA512

                                                                                                                                              6295f751ed305478d69a6c0771d2bae71a3dfcdbe52c4f1bafb8fed5783042cd7bd4d5dd4535cea1a35fdf8b19f1545aa4806195c33d333c6b91b9d944e3c520

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\System32\vds.exe
                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              MD5

                                                                                                                                              2263623348211cfa4ca2ea7d6c9b394b

                                                                                                                                              SHA1

                                                                                                                                              886659f76316a7c5f8a468b3ce8b110ed6a18650

                                                                                                                                              SHA256

                                                                                                                                              f36c403194ea298acccc6481da278943ec65dc74f65aa1aa469a6c42b7f2d344

                                                                                                                                              SHA512

                                                                                                                                              4633f4651c52c7a31fcf8f57963d735be2597c37d00be51850d855e9e4417f76e50a9751eb5af2a05984b2996ccb1c966dda515f7c45f19d32d81b61494180d4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Temp\CabB8B5.tmp
                                                                                                                                              Filesize

                                                                                                                                              29KB

                                                                                                                                              MD5

                                                                                                                                              d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                              SHA1

                                                                                                                                              e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                              SHA256

                                                                                                                                              a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                              SHA512

                                                                                                                                              17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Temp\TarBAAA.tmp
                                                                                                                                              Filesize

                                                                                                                                              81KB

                                                                                                                                              MD5

                                                                                                                                              b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                              SHA1

                                                                                                                                              7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                              SHA256

                                                                                                                                              725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                              SHA512

                                                                                                                                              f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              105KB

                                                                                                                                              MD5

                                                                                                                                              d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                              SHA1

                                                                                                                                              9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                              SHA256

                                                                                                                                              dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                              SHA512

                                                                                                                                              5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                              MD5

                                                                                                                                              4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                              SHA1

                                                                                                                                              f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                              SHA256

                                                                                                                                              c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                              SHA512

                                                                                                                                              c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              9958f23efa2a86f8195f11054f94189a

                                                                                                                                              SHA1

                                                                                                                                              78ec93b44569ea7ebce452765568da5c73511931

                                                                                                                                              SHA256

                                                                                                                                              3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

                                                                                                                                              SHA512

                                                                                                                                              3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              1.0MB

                                                                                                                                              MD5

                                                                                                                                              598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                              SHA1

                                                                                                                                              5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                              SHA256

                                                                                                                                              e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                              SHA512

                                                                                                                                              774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              58KB

                                                                                                                                              MD5

                                                                                                                                              3d6987fc36386537669f2450761cdd9d

                                                                                                                                              SHA1

                                                                                                                                              7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                              SHA256

                                                                                                                                              34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                              SHA512

                                                                                                                                              1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              205KB

                                                                                                                                              MD5

                                                                                                                                              0a41e63195a60814fe770be368b4992f

                                                                                                                                              SHA1

                                                                                                                                              d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                              SHA256

                                                                                                                                              4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                              SHA512

                                                                                                                                              1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\1b2e8d1b2dae3c6c260d45e95bbd211e\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              122KB

                                                                                                                                              MD5

                                                                                                                                              be6dbfd4c53dc99cddd5e2d0dd6cdddb

                                                                                                                                              SHA1

                                                                                                                                              c4430d1968b4eade337c5ed91dc54b520721853e

                                                                                                                                              SHA256

                                                                                                                                              3b29f764b50dd849d680f4d265fff3dee172400a497ec61a8da7003e4f916756

                                                                                                                                              SHA512

                                                                                                                                              3ce5cd6b0f9af6028702c9ec8b9b5ca809476c0b1c913ef03bd3f37d813f2b548e397879fc563b31b311d4c80b1be987329aa83f3eb040ef4fbfa68757db4230

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              43KB

                                                                                                                                              MD5

                                                                                                                                              68c51bcdc03e97a119431061273f045a

                                                                                                                                              SHA1

                                                                                                                                              6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                              SHA256

                                                                                                                                              4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                              SHA512

                                                                                                                                              d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              198KB

                                                                                                                                              MD5

                                                                                                                                              9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                              SHA1

                                                                                                                                              ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                              SHA256

                                                                                                                                              469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                              SHA512

                                                                                                                                              58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\67969e192ec21ec545d8429ce3d0d817\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              271KB

                                                                                                                                              MD5

                                                                                                                                              821e8b80e0d030dcdd36d6eb1506c312

                                                                                                                                              SHA1

                                                                                                                                              1cfb2c32071feaa6bcb35cdf04f6f5a8c64f1fe4

                                                                                                                                              SHA256

                                                                                                                                              4a9ad06464be1f3e3d724080c40e4c14b51b8956c3849359ce4e7adf39b0c7c7

                                                                                                                                              SHA512

                                                                                                                                              2204d46ea3f2d2917e81ae859c236d56313630af96748eab7c5dcba4d1768832d24972684d290c2fa54a1060cd97c2e7795a9527540c824c013ab5f47d1e75b4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6969a8b8cc8dd1f70ac3541e1e3a0365\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              305KB

                                                                                                                                              MD5

                                                                                                                                              7f65bf8076b08e9a9b35c541a1dc0d2d

                                                                                                                                              SHA1

                                                                                                                                              9427f0b207edccc106b62e825d4e9474f1d99583

                                                                                                                                              SHA256

                                                                                                                                              1d36c58b6cb18eb5772c3d00fb0bfb121d3ae8958f60b94c3bed6aa48e3d68ba

                                                                                                                                              SHA512

                                                                                                                                              0704b90e6760be70debdac37756231011f83451dbfae62e4f32ee992b0ace1170fd8877c92118d0c8c0c6e317b405db35d58f1d4de988ac8c98550ec3153d8e3

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              70KB

                                                                                                                                              MD5

                                                                                                                                              57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                              SHA1

                                                                                                                                              da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                              SHA256

                                                                                                                                              1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                              SHA512

                                                                                                                                              1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              87KB

                                                                                                                                              MD5

                                                                                                                                              ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                              SHA1

                                                                                                                                              4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                              SHA256

                                                                                                                                              b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                              SHA512

                                                                                                                                              d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8790984f6b1e626c40cd32be47d1894e\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              221KB

                                                                                                                                              MD5

                                                                                                                                              37fdfe1c5592830d9b181acfbe79c218

                                                                                                                                              SHA1

                                                                                                                                              9eff4145332206aaf7b1f92ae6061b63fb1ea16e

                                                                                                                                              SHA256

                                                                                                                                              aa3a9114c5069c2b49b6759877f2d62ac2c459710bcb7fcea214ae3da06ca85e

                                                                                                                                              SHA512

                                                                                                                                              a9396e348e2974488fa65b8fe7e98c89d6c8c958b71fc2f0d2945f4a28a037809933ec9f117613630805972ea2c3b2442f98c8557ff2b6b0c705915becd0f7c2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              82KB

                                                                                                                                              MD5

                                                                                                                                              2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                              SHA1

                                                                                                                                              66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                              SHA256

                                                                                                                                              37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                              SHA512

                                                                                                                                              cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              58KB

                                                                                                                                              MD5

                                                                                                                                              a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                              SHA1

                                                                                                                                              500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                              SHA256

                                                                                                                                              1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                              SHA512

                                                                                                                                              b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              85KB

                                                                                                                                              MD5

                                                                                                                                              5180107f98e16bdca63e67e7e3169d22

                                                                                                                                              SHA1

                                                                                                                                              dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                              SHA256

                                                                                                                                              d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                              SHA512

                                                                                                                                              27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              298KB

                                                                                                                                              MD5

                                                                                                                                              5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                              SHA1

                                                                                                                                              1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                              SHA256

                                                                                                                                              5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                              SHA512

                                                                                                                                              58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              43KB

                                                                                                                                              MD5

                                                                                                                                              dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                              SHA1

                                                                                                                                              d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                              SHA256

                                                                                                                                              f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                              SHA512

                                                                                                                                              8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              124KB

                                                                                                                                              MD5

                                                                                                                                              929653b5b019b4555b25d55e6bf9987b

                                                                                                                                              SHA1

                                                                                                                                              993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                              SHA256

                                                                                                                                              2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                              SHA512

                                                                                                                                              effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              MD5

                                                                                                                                              10b5a285eafccdd35390bb49861657e7

                                                                                                                                              SHA1

                                                                                                                                              62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                              SHA256

                                                                                                                                              5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                              SHA512

                                                                                                                                              19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                              Filesize

                                                                                                                                              88KB

                                                                                                                                              MD5

                                                                                                                                              1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                              SHA1

                                                                                                                                              4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                              SHA256

                                                                                                                                              9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                              SHA512

                                                                                                                                              e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                              Download Submit

                                                                                                                                            • \Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              01acb1b3c07360c77469ce3f578bb753

                                                                                                                                              SHA1

                                                                                                                                              15f3d4409e5226be461efc894f45cb800ea9dfe7

                                                                                                                                              SHA256

                                                                                                                                              242c174f418063c125c4e432d5939293a56417cf831e3d7796d546d05ccd32fe

                                                                                                                                              SHA512

                                                                                                                                              d6981d7173b7712ac1c9d0336ccf8d62a8f148091bf56aa38e219198fdaec8cde5fb51c3b8f9883a38c4070699dfe7434997672a34fe13a9c523418a647da900

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                              Filesize

                                                                                                                                              648KB

                                                                                                                                              MD5

                                                                                                                                              91e0f28fe309188c9d72b90968f89c4d

                                                                                                                                              SHA1

                                                                                                                                              ac03299a66117745baa6cc5c350d48cc5b64660d

                                                                                                                                              SHA256

                                                                                                                                              a77700fc246cdc2cf7350b3b9a686da68206374414158bac4ee79c3af3edf57a

                                                                                                                                              SHA512

                                                                                                                                              d378904a0df1c309fc5cc43e641ce7b8efe679e3a86d98456dedafcd2d81e8c74fb27b54a1a20f96e8fc2b53e811366981abffcb7089f88901f5b362858a4214

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                              Filesize

                                                                                                                                              603KB

                                                                                                                                              MD5

                                                                                                                                              a53404c8dec9da0c1b7693d74c708bf9

                                                                                                                                              SHA1

                                                                                                                                              e0328178243c6eb95236aa42cc32eee3feb8224e

                                                                                                                                              SHA256

                                                                                                                                              00a4fe39fad3827441c4f0c3b21136825ca504e43433f6e51983f97982bc5ba1

                                                                                                                                              SHA512

                                                                                                                                              d7bc202c56a9dc97252af43daead6a7d69c07247097f4c0cda7dcc9f57dfacc9e9123e2e4e5d8d8fb1b18e4be2f415b9ecf229978c865ac3dc4d7a23802643d9

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\System32\Locator.exe
                                                                                                                                              Filesize

                                                                                                                                              577KB

                                                                                                                                              MD5

                                                                                                                                              9adab1cc8d6b30af331c99ceae32965a

                                                                                                                                              SHA1

                                                                                                                                              155e99f8479f661b4a15649fa9b6212bea14251a

                                                                                                                                              SHA256

                                                                                                                                              36cb5dcaee55e96ad4ba2182d6f01ff517cfea6f312a4712e4276614e251c77c

                                                                                                                                              SHA512

                                                                                                                                              fd2d3614ba5a67dde1f8ca2cd79702fb03a681206ecf6ef9061e4875759a4358bd3e58ba79274008c58a8a12064f779eb92d2f42b8d4eaa36680309b169a41c5

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\System32\alg.exe
                                                                                                                                              Filesize

                                                                                                                                              644KB

                                                                                                                                              MD5

                                                                                                                                              0b23571131de0b9fea1ca00c52f356b4

                                                                                                                                              SHA1

                                                                                                                                              6d8caafd2dc44ae9195a3637f66a1e29aae6d9d8

                                                                                                                                              SHA256

                                                                                                                                              85c660828ef096464fc74ed9afee68ef3cf2dca489ce29f21fbae78974636487

                                                                                                                                              SHA512

                                                                                                                                              9e3122ccd7c51cce2373021a7563c90ed631c913925e3e06dc8ef3e66ddb64319d4ab117263cbb3636443a2bb064640bcf0b66ece1070d2e398b0090b6781a89

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\System32\msdtc.exe
                                                                                                                                              Filesize

                                                                                                                                              705KB

                                                                                                                                              MD5

                                                                                                                                              8c524041bf8aac120c4f71385eae0ddd

                                                                                                                                              SHA1

                                                                                                                                              4ea1dcb75c7aa691f2abc693890d21c188a5f9fc

                                                                                                                                              SHA256

                                                                                                                                              7c68547dc28a0ba5414a4a50abba68f433dfd8d0c7e5908bc447c419bbe0c9ee

                                                                                                                                              SHA512

                                                                                                                                              863c897b99d7216eb8f254569a41acff06b48fb71326a8b2e5112cfb590794050c4040e98534088d9f6bf3e502dd7924e47bf16d283351c62d2e10761e4a5952

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\System32\msiexec.exe
                                                                                                                                              Filesize

                                                                                                                                              691KB

                                                                                                                                              MD5

                                                                                                                                              e4188330ccfff0f7ff713861fcf28bc6

                                                                                                                                              SHA1

                                                                                                                                              e0863dbae7e56eaedc2cfb9509c04f40d9a29898

                                                                                                                                              SHA256

                                                                                                                                              e396f24b895d3774a2ebdd6e4320e20810437b37a5f1c73e87a4dd5367e4b2fb

                                                                                                                                              SHA512

                                                                                                                                              1f2e2252abbe2f74d23a4fc4d23e0ed82799eb46648ec3a914b908b3b66d55e137c9049ca74f750970d5048ae0ca8c598749a55cb2c8374d8a0d41168584afc4

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\System32\snmptrap.exe
                                                                                                                                              Filesize

                                                                                                                                              581KB

                                                                                                                                              MD5

                                                                                                                                              f3c05e3174a3717eb999402633d26fac

                                                                                                                                              SHA1

                                                                                                                                              5765ec3bafa20f9b95626991773e227afef11d40

                                                                                                                                              SHA256

                                                                                                                                              eafb966391bdc8b4f574a1366622e6743b2c9b9e193d9ca0a5e55892095f57a2

                                                                                                                                              SHA512

                                                                                                                                              a82475dda06d28aa2c3cd64dcca215bfc1019a99ca7f50bab78d375768365eb3589245debbf81565efc674d7222117e268c0a59990cc757a494f806fe85cd548

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                              Filesize

                                                                                                                                              765KB

                                                                                                                                              MD5

                                                                                                                                              61e334c327b99865434de8b56a28a6be

                                                                                                                                              SHA1

                                                                                                                                              bb5d60386f260b8b6ad0a23ebf652e05cdcfd6d8

                                                                                                                                              SHA256

                                                                                                                                              4567c60df9d5594d7c747f3f09984dbf874a53715820f85df968515b62a461f1

                                                                                                                                              SHA512

                                                                                                                                              5ca2bea747b7dfd31d48e9ee4aa6da5a4b23e4bdd010fb461735929925c963d738821c9a7932997fd700e4edd47c0b3c9a42d8001ec653d8688c34f040c93920

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\System32\wbengine.exe
                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              95dd427c5ca1a519ca3bda600b72cad5

                                                                                                                                              SHA1

                                                                                                                                              afc0abb6f781bdf2e63c66bf7920c93e4fc0a89d

                                                                                                                                              SHA256

                                                                                                                                              fea48793a96027a9fdb0f4f725a444ad03d1dade72e22bb9ceeef12507363d24

                                                                                                                                              SHA512

                                                                                                                                              3f39494209c36c4064a9ade42bda446fdc974512b7f78e383e69b119634e96ab1eafdab1f08261e267c42422422888f9a398c308544d4073d8287a79325104c9

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\ehome\ehrecvr.exe
                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              MD5

                                                                                                                                              971ef5baad3a813b0f03ba721e863aaf

                                                                                                                                              SHA1

                                                                                                                                              63c1c765d9dac8eda31a59b79150ce69c9c840ad

                                                                                                                                              SHA256

                                                                                                                                              85866c969205ebb912930dc6813dc18f9658a99ffc01beb2745ef38a30f20298

                                                                                                                                              SHA512

                                                                                                                                              42df0c79ee98fab3203401cd365511ab35333a9fd72ca49466e2f30f5927134bdcc18c1cff6dd2932fa69b8387f36f9e816c4074a65aff3605edf69bda0d9aed

                                                                                                                                              Download Submit

                                                                                                                                            • \Windows\ehome\ehsched.exe
                                                                                                                                              Filesize

                                                                                                                                              691KB

                                                                                                                                              MD5

                                                                                                                                              1a49542bbe6227791d90d161eedb9f69

                                                                                                                                              SHA1

                                                                                                                                              5ce738e1ab1df874d1cef45c3ed77f5d3523b62f

                                                                                                                                              SHA256

                                                                                                                                              269a5e171f61f61e904de2d329afe44a4e8cece5866377f2cf8b047bcc8ddbaf

                                                                                                                                              SHA512

                                                                                                                                              8fc0d0ca87ac6baf938b25d75a8e2e33fdbfe25a554f771398ca2051f1d62775f26ad991a8e135e7a916374ab956fded4648f414e2e2c5224e735f57e28a0779

                                                                                                                                              Download Submit

                                                                                                                                            • memory/280-82-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              696KB

                                                                                                                                              Download

                                                                                                                                            • memory/280-195-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              696KB

                                                                                                                                              Download

                                                                                                                                            • memory/280-89-0x0000000000AD0000-0x0000000000B30000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/280-83-0x0000000000AD0000-0x0000000000B30000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/320-718-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/320-733-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/372-271-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/372-569-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/620-275-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              784KB

                                                                                                                                              Download

                                                                                                                                            • memory/620-587-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              784KB

                                                                                                                                              Download

                                                                                                                                            • memory/656-142-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              696KB

                                                                                                                                              Download

                                                                                                                                            • memory/668-602-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/668-624-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/668-243-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              696KB

                                                                                                                                              Download

                                                                                                                                            • memory/668-193-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              696KB

                                                                                                                                              Download

                                                                                                                                            • memory/680-267-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              696KB

                                                                                                                                              Download

                                                                                                                                            • memory/680-239-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              696KB

                                                                                                                                              Download

                                                                                                                                            • memory/928-209-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/928-102-0x0000000000380000-0x00000000003E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/928-101-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/928-108-0x0000000000380000-0x00000000003E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/964-626-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/964-298-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/1036-575-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1036-553-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-66-0x00000000004B0000-0x0000000000517000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              412KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-65-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-192-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-71-0x00000000004B0000-0x0000000000517000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              412KB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-264-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              728KB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-169-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              728KB

                                                                                                                                              Download

                                                                                                                                            • memory/1208-608-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1208-588-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1256-173-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              808KB

                                                                                                                                              Download

                                                                                                                                            • memory/1256-165-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              808KB

                                                                                                                                              Download

                                                                                                                                            • memory/1300-265-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/1300-551-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/1312-448-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1312-383-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1364-730-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1364-741-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1376-279-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1376-393-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1400-742-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1400-747-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1524-507-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/1524-257-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/1596-303-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/1596-647-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/1684-436-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              596KB

                                                                                                                                              Download

                                                                                                                                            • memory/1684-240-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              596KB

                                                                                                                                              Download

                                                                                                                                            • memory/1732-638-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1732-628-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1752-191-0x0000000000510000-0x00000000005C2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              712KB

                                                                                                                                              Download

                                                                                                                                            • memory/1752-179-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              712KB

                                                                                                                                              Download

                                                                                                                                            • memory/1752-270-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              712KB

                                                                                                                                              Download

                                                                                                                                            • memory/1760-7-0x00000000002F0000-0x0000000000357000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              412KB

                                                                                                                                              Download

                                                                                                                                            • memory/1760-1-0x00000000002F0000-0x0000000000357000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              412KB

                                                                                                                                              Download

                                                                                                                                            • memory/1760-100-0x0000000000400000-0x0000000000584000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.5MB

                                                                                                                                              Download

                                                                                                                                            • memory/1760-0-0x0000000000400000-0x0000000000584000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.5MB

                                                                                                                                              Download

                                                                                                                                            • memory/1760-6-0x00000000002F0000-0x0000000000357000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              412KB

                                                                                                                                              Download

                                                                                                                                            • memory/1912-496-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/1912-437-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2072-238-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              30.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/2072-164-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              30.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/2080-570-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2080-586-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2136-121-0x0000000000370000-0x00000000003D0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/2136-120-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              712KB

                                                                                                                                              Download

                                                                                                                                            • memory/2136-114-0x0000000000370000-0x00000000003D0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/2136-215-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              712KB

                                                                                                                                              Download

                                                                                                                                            • memory/2176-653-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2176-685-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2212-234-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2212-137-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2232-664-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2232-648-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2240-706-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2240-709-0x0000000003BE0000-0x0000000003C9A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              744KB

                                                                                                                                              Download

                                                                                                                                            • memory/2240-721-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2320-689-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2320-681-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2456-497-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              600KB

                                                                                                                                              Download

                                                                                                                                            • memory/2456-246-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              600KB

                                                                                                                                              Download

                                                                                                                                            • memory/2456-46-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              668KB

                                                                                                                                              Download

                                                                                                                                            • memory/2456-48-0x00000000001F0000-0x0000000000250000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/2456-93-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              668KB

                                                                                                                                              Download

                                                                                                                                            • memory/2456-54-0x00000000001F0000-0x0000000000250000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/2468-708-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2520-537-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2520-513-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2560-213-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/2560-297-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/2576-748-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2600-38-0x00000000003D0000-0x0000000000437000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              412KB

                                                                                                                                              Download

                                                                                                                                            • memory/2600-62-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              636KB

                                                                                                                                              Download

                                                                                                                                            • memory/2600-30-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              636KB

                                                                                                                                              Download

                                                                                                                                            • memory/2600-31-0x00000000003D0000-0x0000000000437000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              412KB

                                                                                                                                              Download

                                                                                                                                            • memory/2664-516-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2664-503-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              672KB

                                                                                                                                              Download

                                                                                                                                            • memory/2676-26-0x0000000000800000-0x0000000000860000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/2676-141-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              628KB

                                                                                                                                              Download

                                                                                                                                            • memory/2676-18-0x0000000000800000-0x0000000000860000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/2676-17-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              628KB

                                                                                                                                              Download

                                                                                                                                            • memory/2744-278-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              724KB

                                                                                                                                              Download

                                                                                                                                            • memory/2744-196-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              724KB

                                                                                                                                              Download

                                                                                                                                            • memory/2844-216-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              600KB

                                                                                                                                              Download

                                                                                                                                            • memory/2844-302-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              600KB

                                                                                                                                              Download

                                                                                                                                            • memory/2936-136-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              656KB

                                                                                                                                              Download

                                                                                                                                            • memory/2936-13-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              656KB

                                                                                                                                              Download