Overview

overview

7

Static

static

3

2024-04-30...re.exe

windows7-x64

7

2024-04-30...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/04/2024, 10:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-30_610636f011d24d151dd203123869c60d_bkransomware.exe

  • Size

    1.8MB

  • MD5

    610636f011d24d151dd203123869c60d

  • SHA1

    282a03de9da80b63eefc7f63b4324925f043e766

  • SHA256

    67a2971c4c249cf80ef1d6bf0f65ee00c11ce2b2ea0fde79c01c70beaf182a87

  • SHA512

    a60a9c9164d58cffb6f96c73ee56493113241b9822ac175161e005691649425b0bd75f49bf80a464b8632941bb27a4be556218bf82d15f374785ef64bb174b5e

  • SSDEEP

    49152:CE19+ApwXk1QE1RzsEQPaxHN57DcMlQpRQQMKMZ:H93wXmoKB3zlQpRQQY

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 61 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-30_610636f011d24d151dd203123869c60d_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-30_610636f011d24d151dd203123869c60d_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2212
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2460
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2580
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2372
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2412
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 250 -NGENProcess 258 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 258 -NGENProcess 1d4 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1128
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1e8 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2660
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 240 -NGENProcess 244 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2788
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 264 -NGENProcess 250 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2988
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 1e8 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 244 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1816
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 26c -NGENProcess 268 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1776
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 258 -NGENProcess 244 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1192
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 278 -NGENProcess 264 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1680
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 268 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2064
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 258 -NGENProcess 284 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:940
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 288 -NGENProcess 268 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2496
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 280 -NGENProcess 28c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2204
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 264 -NGENProcess 290 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1808
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 264 -NGENProcess 27c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2020
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 284 -NGENProcess 290 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:540
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 284 -NGENProcess 264 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2416
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 284 -NGENProcess 298 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 294 -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 294 -NGENProcess 284 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2a4 -NGENProcess 2ac -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1760
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2616
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2388
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 21c -NGENProcess 214 -Pipe 204 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2872
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 25c -NGENProcess 1c0 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:540
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 234 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1824
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 214 -Pipe 230 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2820
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 1c0 -Pipe 210 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1108
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 214 -NGENProcess 1c0 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1408
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 214 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1744
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 268 -NGENProcess 234 -Pipe 1c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:540
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 27c -NGENProcess 250 -Pipe 21c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2432
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 250 -NGENProcess 214 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 284 -NGENProcess 234 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1428
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 234 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2412
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 28c -NGENProcess 214 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1084
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 214 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
        PID:2496
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 294 -NGENProcess 27c -Pipe 250 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:856
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
        2⤵
          PID:2860
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 234 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1776
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
          2⤵
            PID:332
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 214 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2664
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
            2⤵
              PID:908
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1168
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
              2⤵
                PID:1408
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2844
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
                2⤵
                  PID:1228
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 28c -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:436
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"
                  2⤵
                    PID:2656
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:848
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
                    2⤵
                      PID:2364
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 29c -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2412
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
                      2⤵
                        PID:2816
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2a4 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:2592
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
                        2⤵
                          PID:1072
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:1732
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
                          2⤵
                            PID:820
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2696
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:912
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"
                            2⤵
                              PID:1744
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 278 -Comment "NGen Worker Process"
                              2⤵
                                PID:1748
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2812
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d4 -Pipe 260 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:952
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    PID:2168
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e8 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2768
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f4 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2956
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 308 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:2416
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 304 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:820
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 310 -NGENProcess 2cc -Pipe 2fc -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2812
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 30c -Pipe 2ec -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1572
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2032
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2cc -Pipe 2f8 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2056
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 308 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2660
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2e8 -Pipe 300 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:2288
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2cc -Pipe 310 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1228
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2060
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2e8 -Pipe 318 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1108
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2cc -Pipe 31c -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1552
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 30c -Pipe 320 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1400
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2e8 -Pipe 324 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:1968
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2cc -Pipe 328 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:940
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2544
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2e8 -Pipe 330 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2888
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2cc -Pipe 334 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1164
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2800
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2e8 -Pipe 33c -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:644
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2cc -Pipe 340 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:1356
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 10c -NGENProcess 350 -Pipe 30c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:2084
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 10c -InterruptEvent 254 -NGENProcess 358 -Pipe 34c -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2736
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 348 -NGENProcess 344 -Pipe 2cc -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1212
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 360 -NGENProcess 350 -Pipe 108 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    PID:2364
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 350 -NGENProcess 254 -Pipe 358 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:1460
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 368 -NGENProcess 344 -Pipe 354 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2432
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 364 -Pipe 10c -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2032
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 254 -Pipe 348 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:1196
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 344 -Pipe 35c -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2324
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 364 -Pipe 360 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2420
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 254 -Pipe 350 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2544
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 344 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2344
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 364 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:1976
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 254 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1004
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 344 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2972
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 364 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:1988
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 254 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:1748
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 344 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2992
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 390 -NGENProcess 39c -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2636
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 388 -NGENProcess 344 -Pipe 2e8 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2896
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 3a0 -NGENProcess 398 -Pipe 254 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1572
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 39c -Pipe 240 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2696
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 344 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:752
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 398 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2660
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 39c -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2956
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 344 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:1748
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 398 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1544
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 39c -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:1612
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 344 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2248
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 398 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:2284
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 39c -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1428
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 344 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:752
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 398 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1148
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 39c -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2872
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 344 -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:488
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 344 -NGENProcess 3d0 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1128
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 3e0 -NGENProcess 39c -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1824
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 39c -NGENProcess 3d8 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1228
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3e8 -NGENProcess 3d0 -Pipe 3d4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:952
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3d0 -NGENProcess 3e0 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:1424
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3f0 -NGENProcess 3d8 -Pipe 344 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:2556
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 3ec -Pipe 3cc -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:932
                                                                                                                                              • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:1668
                                                                                                                                              • C:\Windows\ehome\ehsched.exe
                                                                                                                                                C:\Windows\ehome\ehsched.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1968
                                                                                                                                              • C:\Windows\eHome\EhTray.exe
                                                                                                                                                "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                1⤵
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                PID:1676
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1512
                                                                                                                                              • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:372
                                                                                                                                              • C:\Windows\ehome\ehRec.exe
                                                                                                                                                C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2844
                                                                                                                                              • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:1284
                                                                                                                                              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1632
                                                                                                                                              • C:\Windows\System32\msdtc.exe
                                                                                                                                                C:\Windows\System32\msdtc.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:600
                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:1708
                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2104
                                                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2480
                                                                                                                                              • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1492
                                                                                                                                              • C:\Windows\system32\locator.exe
                                                                                                                                                C:\Windows\system32\locator.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2784
                                                                                                                                              • C:\Windows\System32\snmptrap.exe
                                                                                                                                                C:\Windows\System32\snmptrap.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2764
                                                                                                                                              • C:\Windows\System32\vds.exe
                                                                                                                                                C:\Windows\System32\vds.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1344
                                                                                                                                              • C:\Windows\system32\vssvc.exe
                                                                                                                                                C:\Windows\system32\vssvc.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:1800
                                                                                                                                              • C:\Windows\system32\wbengine.exe
                                                                                                                                                "C:\Windows\system32\wbengine.exe"
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:1964
                                                                                                                                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:744
                                                                                                                                              • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2216
                                                                                                                                              • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2156
                                                                                                                                                • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                  2⤵
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2928
                                                                                                                                                • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                                                                                  2⤵
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:1980
                                                                                                                                                • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2340
                                                                                                                                              • C:\Windows\system32\dllhost.exe
                                                                                                                                                C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2440

                                                                                                                                              Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                Filesize

                                                                                                                                                706KB

                                                                                                                                                MD5

                                                                                                                                                cbd1c6dc3ce2b13618a9423ea2ef993a

                                                                                                                                                SHA1

                                                                                                                                                7090885cd4ccdd4c805656dcacce82eef90722e0

                                                                                                                                                SHA256

                                                                                                                                                51f6859f3f5b6285f903c53af51e5813d9257796dae98715fbb8c304b62df43d

                                                                                                                                                SHA512

                                                                                                                                                32480d1dad901a024357c3250f2568ff780677ca87bbb5b57435936ebb7fe56bec3791b63f361c5cba5ba0c39ec9a15994f6b98af59476ba7e1a121f01e3d53d

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                Filesize

                                                                                                                                                30.1MB

                                                                                                                                                MD5

                                                                                                                                                7d86a9e1c1004f56f00d19bf01d93881

                                                                                                                                                SHA1

                                                                                                                                                4dc06da48686b34ca1dfaa04450fc8f52c3a12fa

                                                                                                                                                SHA256

                                                                                                                                                16cf74178f95ba9d82dc7e99472f84c0713c37d0e8843797ea7df444a5a10be8

                                                                                                                                                SHA512

                                                                                                                                                5800f6f7447e1b4b352acc152a9cf9a122559c818100d1fd23f6276c22c9f05799100ecb0d920679ea3183b87b32b5fc5e4cf1e85bfba9e2f6a90e5a53edd633

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                Filesize

                                                                                                                                                781KB

                                                                                                                                                MD5

                                                                                                                                                a204893299c499017e826f21af400282

                                                                                                                                                SHA1

                                                                                                                                                e97f32aabd61b17fbf0baa727becf2eb8697dae5

                                                                                                                                                SHA256

                                                                                                                                                b504f9750175eac9a4ab797924aa5ba66c33b3cc1ee462d6af2ea1e5de927c4d

                                                                                                                                                SHA512

                                                                                                                                                ba162049abb44d9a2bb881fe246ecac876e14625d13e218c6366462f3fab2c711a31b975467b177167048d8f15114d205351df064739e287758e7ae5692e9f0f

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                Filesize

                                                                                                                                                5.2MB

                                                                                                                                                MD5

                                                                                                                                                468ddcb82a22835d4799cdd21bacc348

                                                                                                                                                SHA1

                                                                                                                                                ce1904b6e8e68d3800962c76a589fea805961e4f

                                                                                                                                                SHA256

                                                                                                                                                bede41a43252b0a8ec2adde70f3e700f595a3e519debf41d21c6dd7e315eff07

                                                                                                                                                SHA512

                                                                                                                                                661315d8c5dbe0dbcdddef09e6fabed4d094843424aec29730548d5a1ce1cdd584686d5661864eb698aa98f83f8f18b115cd15e68861bb3a2bd40cc5301350ec

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                MD5

                                                                                                                                                848f9b108d29ae085caa6273a28a8c13

                                                                                                                                                SHA1

                                                                                                                                                61dfe1860e7b5cb549dd8086ee5107a0512885cc

                                                                                                                                                SHA256

                                                                                                                                                97ab5b4f90a62d88fc448bc971a4469d2ae8fc1ef8f82e054d304e0d1e1a4811

                                                                                                                                                SHA512

                                                                                                                                                116adb0ca8ae798c00cc0fe46728445c3821767049c96f58166c63482f516539e86cbcf98203f44e40bf2e1f4efbd15bf7294a82f2b109d9380b38e9086655d2

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                                MD5

                                                                                                                                                ce87bfb20733b33f244d44fe65c95c2f

                                                                                                                                                SHA1

                                                                                                                                                94f033eaa005eb13ea2b1c80b828a9b2010ef122

                                                                                                                                                SHA256

                                                                                                                                                614b4d273451eedd76ab1613c2e9c5310518607a43e1bc88152ddd80bb9a49e7

                                                                                                                                                SHA512

                                                                                                                                                5c85ede84fdfc32c8654dfc1984a1038536aa5c65eb4d27ed80cc20fb905be0e148e62974c32aa666455fd17326c9db93e7e88075a1a15be45e8a59d429fbfa5

                                                                                                                                                Download Submit

                                                                                                                                              • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                MD5

                                                                                                                                                e4e8bd22f7cb41cb482ed6d096f5454a

                                                                                                                                                SHA1

                                                                                                                                                fd9e9fbb155380f3cebd918891f934e7e2b9939f

                                                                                                                                                SHA256

                                                                                                                                                4e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7

                                                                                                                                                SHA512

                                                                                                                                                a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                Filesize

                                                                                                                                                24B

                                                                                                                                                MD5

                                                                                                                                                b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                SHA1

                                                                                                                                                9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                SHA256

                                                                                                                                                7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                SHA512

                                                                                                                                                cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                Filesize

                                                                                                                                                872KB

                                                                                                                                                MD5

                                                                                                                                                d3cb22ccf1d7854b6661cd83998c6ce6

                                                                                                                                                SHA1

                                                                                                                                                376b222afcd416eca14b72b2f254dafa507a2ba4

                                                                                                                                                SHA256

                                                                                                                                                230c9847d6c5aaa12171c32128fe6c68ffff6f878136306f652b1ce66c914aba

                                                                                                                                                SHA512

                                                                                                                                                f4cd18fda6ecf463c6678857a7664c5fdb540155d4e3f6d6e61cc905a6107f574f44a3f4c83fb5aa31428aab224f437add26c526d55d21ed08f64f119fbe84b7

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                Filesize

                                                                                                                                                678KB

                                                                                                                                                MD5

                                                                                                                                                70e7b1f295b4910ee84fb321d32e1a6a

                                                                                                                                                SHA1

                                                                                                                                                bee31dd255d83d660ff4a833f2be0a38853aed1e

                                                                                                                                                SHA256

                                                                                                                                                c4ec8421384213a2495d65c4e67c47cfd74b2b5359cbcfd54928db957480a170

                                                                                                                                                SHA512

                                                                                                                                                d1caacd7c4a929cdbce296724feaced42b6030870f16860f91cf8ad323235ea616ae12ce8520144224edbb5028f4b13ec48e37836bae4e290183f18e7dc5c126

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                                Filesize

                                                                                                                                                8KB

                                                                                                                                                MD5

                                                                                                                                                f83a24d7a1b7dfd343eb968cea205b06

                                                                                                                                                SHA1

                                                                                                                                                5b9e0741d00cca072aa728e94ff96cdadf0af277

                                                                                                                                                SHA256

                                                                                                                                                68a97a1c35a82a5c1cf635d3802d0ca6de991e365ecefb6b36aeed655e20c319

                                                                                                                                                SHA512

                                                                                                                                                acb9d1bf975108c163a75903eb6af724c8d0a0fd24766bf11e22b998d0b852a6b96a0e83681bb8c460bacac2d748b7040533292910e3749e10ea9d9b9db1378d

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                Filesize

                                                                                                                                                625KB

                                                                                                                                                MD5

                                                                                                                                                8d1abf64ad8e938964fc5ce92bbc7874

                                                                                                                                                SHA1

                                                                                                                                                c700f9383a0c661f4884b7abeeb1d45a771316a5

                                                                                                                                                SHA256

                                                                                                                                                b59df89848cc790d80a28179eaf32c1ccef072c28aa2fc7854db6aa263bb5196

                                                                                                                                                SHA512

                                                                                                                                                75d0ffb34faa67d941446c261482bd89ad9561369e367facd164c4f348193666e7078e6cdb041c0fdd367467f88d2d2a066a7013f3a7498524d2fa52ee5c7f31

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                Filesize

                                                                                                                                                1003KB

                                                                                                                                                MD5

                                                                                                                                                b66d96050637774e42e0bab8350e6a4e

                                                                                                                                                SHA1

                                                                                                                                                060dbe8da28d70ca8d07cb54cf7744350ad7b471

                                                                                                                                                SHA256

                                                                                                                                                aa0e714c92e0ccf79793b0230d0665acf01bdc7751255ddfde0579960a7ef75a

                                                                                                                                                SHA512

                                                                                                                                                ffc734e0f2c859203cd4d0d06c3cc79c368438784111ed4afa2537a07119437b954c142869555b8134c25e539b30caf19bdc5fb405207e972d6899016477f42f

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                Filesize

                                                                                                                                                656KB

                                                                                                                                                MD5

                                                                                                                                                1832e071d0d2d3c36a20df8978e9ac10

                                                                                                                                                SHA1

                                                                                                                                                92f2d51a8b0324b81c68b53f94c7343f70003e47

                                                                                                                                                SHA256

                                                                                                                                                b0aeda63f40536263f9c3c9e19edf02e6575f7bc8123f5c1c44fcc125ad6c17a

                                                                                                                                                SHA512

                                                                                                                                                0b01e019bc6068effe7dab242333e364615a369a896450565f4a0863495a9e3c718f6f184a502afbd0c2eaa931518a1c06cd7b0688c5f3a6c6204948bce899a6

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                Filesize

                                                                                                                                                587KB

                                                                                                                                                MD5

                                                                                                                                                b82f80f9b3f6c68ba2c00106b0adf16e

                                                                                                                                                SHA1

                                                                                                                                                972542d5a01c4925cb5fe09450ce742ea9ddb1cc

                                                                                                                                                SHA256

                                                                                                                                                87b1b0cef3b6afc99415cdc4f3c787ab04ee54a8bd92dd377af05da69a2251b2

                                                                                                                                                SHA512

                                                                                                                                                b4cd2c7f5255f6b37f0eb54b3567fd3deac99aca0df61f1064dbf4948b281e9334359c215f71897afff49870d08b51e0ec8da0c509476ec7dbb16ed70db44269

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                MD5

                                                                                                                                                3efa5646638d284f9e1b2b1e09a6864b

                                                                                                                                                SHA1

                                                                                                                                                9899dee6099a478cc343ae93ff2d181d262226fc

                                                                                                                                                SHA256

                                                                                                                                                8acc5a0fa91ff5f1441e82fa8d71fdcc84b54cdf5025a07cb96682c6662672ea

                                                                                                                                                SHA512

                                                                                                                                                e7111431cea6868cc7692d9a72addba53902d47f10dcc5f5a7da52aed35097b9c1e3c4defb8e26382ccd8479f002ddfef0a95923f027d273549053398a603ff2

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\System32\VSSVC.exe
                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                MD5

                                                                                                                                                7dc668ecdb402093c4cea30dd8788b6d

                                                                                                                                                SHA1

                                                                                                                                                c5dfaac76a9ad238ea37bc5705bae6a549fdd5bb

                                                                                                                                                SHA256

                                                                                                                                                1472f2d6aada02493905752e4dd263971cc3edb3a5afbb2b8d0a1e1999182735

                                                                                                                                                SHA512

                                                                                                                                                fe8543dbf08ba30315c742c1a0174fc277ef853e70b85a1d816f08ce6e9c576ce49b1f09ac7a3d139a23c470032447c6639439e8e0003c456bd48018ba6eb228

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\System32\vds.exe
                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                MD5

                                                                                                                                                50da51443aa47ab7d535bba38211aa63

                                                                                                                                                SHA1

                                                                                                                                                91496aa60cff8416c2faea3333ab5ea8fc99cfe8

                                                                                                                                                SHA256

                                                                                                                                                7f28b2608c475930aee2f37ac2f00d81511a286145309156e786506316583902

                                                                                                                                                SHA512

                                                                                                                                                5d01561b45aae5913eb7c9a1863562c911a152546f3e0cc61d499d2d5bf0d6a74882f6eef08ca1f056098396e12b8e44715692099b59b0db94e4cd8dbb4fb02b

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                Filesize

                                                                                                                                                765KB

                                                                                                                                                MD5

                                                                                                                                                18d058bacfcd953f9c160dace1760113

                                                                                                                                                SHA1

                                                                                                                                                c2d48a7963740e84c0f014499455ed8072d58d4f

                                                                                                                                                SHA256

                                                                                                                                                d1be225209e0369425b4950d278e37ddb431ba9b19c8170979233ebecaacbda7

                                                                                                                                                SHA512

                                                                                                                                                a032bc49319fe8cfbddd50f25236d05a611ab3c017f6965f066ad189e554fdd624b7b97daca9e50af39206d3c8b87e13add7695811bd0f9975ea824f2fb806fb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Temp\CabB29D.tmp
                                                                                                                                                Filesize

                                                                                                                                                29KB

                                                                                                                                                MD5

                                                                                                                                                d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                                SHA1

                                                                                                                                                e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                                SHA256

                                                                                                                                                a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                                SHA512

                                                                                                                                                17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\Temp\TarB3F6.tmp
                                                                                                                                                Filesize

                                                                                                                                                81KB

                                                                                                                                                MD5

                                                                                                                                                b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                                SHA1

                                                                                                                                                7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                                SHA256

                                                                                                                                                725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                                SHA512

                                                                                                                                                f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                105KB

                                                                                                                                                MD5

                                                                                                                                                d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                SHA1

                                                                                                                                                9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                SHA256

                                                                                                                                                dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                SHA512

                                                                                                                                                5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                238KB

                                                                                                                                                MD5

                                                                                                                                                0a4ed78b7995d94fa42379f84cd5f8e9

                                                                                                                                                SHA1

                                                                                                                                                90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

                                                                                                                                                SHA256

                                                                                                                                                0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

                                                                                                                                                SHA512

                                                                                                                                                86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                248KB

                                                                                                                                                MD5

                                                                                                                                                4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                SHA1

                                                                                                                                                f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                SHA256

                                                                                                                                                c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                SHA512

                                                                                                                                                c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                1.8MB

                                                                                                                                                MD5

                                                                                                                                                9958f23efa2a86f8195f11054f94189a

                                                                                                                                                SHA1

                                                                                                                                                78ec93b44569ea7ebce452765568da5c73511931

                                                                                                                                                SHA256

                                                                                                                                                3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

                                                                                                                                                SHA512

                                                                                                                                                3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                1.0MB

                                                                                                                                                MD5

                                                                                                                                                598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                                SHA1

                                                                                                                                                5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                                SHA256

                                                                                                                                                e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                                SHA512

                                                                                                                                                774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                58KB

                                                                                                                                                MD5

                                                                                                                                                3d6987fc36386537669f2450761cdd9d

                                                                                                                                                SHA1

                                                                                                                                                7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                SHA256

                                                                                                                                                34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                SHA512

                                                                                                                                                1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                205KB

                                                                                                                                                MD5

                                                                                                                                                0a41e63195a60814fe770be368b4992f

                                                                                                                                                SHA1

                                                                                                                                                d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                SHA256

                                                                                                                                                4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                SHA512

                                                                                                                                                1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                43KB

                                                                                                                                                MD5

                                                                                                                                                68c51bcdc03e97a119431061273f045a

                                                                                                                                                SHA1

                                                                                                                                                6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                SHA256

                                                                                                                                                4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                SHA512

                                                                                                                                                d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                198KB

                                                                                                                                                MD5

                                                                                                                                                9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                SHA1

                                                                                                                                                ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                SHA256

                                                                                                                                                469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                SHA512

                                                                                                                                                58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                70KB

                                                                                                                                                MD5

                                                                                                                                                57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                SHA1

                                                                                                                                                da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                SHA256

                                                                                                                                                1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                SHA512

                                                                                                                                                1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                87KB

                                                                                                                                                MD5

                                                                                                                                                ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                SHA1

                                                                                                                                                4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                SHA256

                                                                                                                                                b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                SHA512

                                                                                                                                                d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\98f812bd6e085e7b3f8df1807c6c19a5\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                122KB

                                                                                                                                                MD5

                                                                                                                                                4301661c7e05ae5ecb310cefd1438f4b

                                                                                                                                                SHA1

                                                                                                                                                d8949b5379bc045233cfe8acb6a1fed3b78c6a7d

                                                                                                                                                SHA256

                                                                                                                                                2f66faf5a13ef4815e8c285c45ee0910e708aacc7cf74a60c134231ae07eda19

                                                                                                                                                SHA512

                                                                                                                                                d73b5e65722aa219393357f8a75c4bb18c179192536f8ddb2452b19b3f2abda602fa38f689e23dfcb1550065f949430bdf0f65c75680ec6a1260a956240698c9

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                82KB

                                                                                                                                                MD5

                                                                                                                                                2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                SHA1

                                                                                                                                                66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                SHA256

                                                                                                                                                37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                SHA512

                                                                                                                                                cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                58KB

                                                                                                                                                MD5

                                                                                                                                                a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                SHA1

                                                                                                                                                500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                SHA256

                                                                                                                                                1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                SHA512

                                                                                                                                                b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\b7193399d5955f989871f277d7f96ea6\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                271KB

                                                                                                                                                MD5

                                                                                                                                                b54253706eb82ae18155a07aded14a84

                                                                                                                                                SHA1

                                                                                                                                                600ce8cd0c50778902ea4ac090b0ce3597a9d39f

                                                                                                                                                SHA256

                                                                                                                                                3f5d2b2983d6347f948ac422f452b296c4b9dc3561529b8eec0e9c44979db076

                                                                                                                                                SHA512

                                                                                                                                                f47a1e6c68ff8d5acbd7a8d47f6745de56557237b7ef501eac7f06eec8f62c4696292a6e6a851d6b4a3d9a4b1fd1db6cb15cda363028c7cc87de4ca9b53b759a

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                85KB

                                                                                                                                                MD5

                                                                                                                                                5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                SHA1

                                                                                                                                                dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                SHA256

                                                                                                                                                d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                SHA512

                                                                                                                                                27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\c1fc09563c55f10418f383c5d7c0a710\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                305KB

                                                                                                                                                MD5

                                                                                                                                                32144d163a6b75214af8542b7430458b

                                                                                                                                                SHA1

                                                                                                                                                cba2c7af73c4c2a362efc70275505cf2be91deaa

                                                                                                                                                SHA256

                                                                                                                                                2d43f66232c4fa4e45b7a5de4684faf91ba16a647e1c7e1639aaec2a57b61847

                                                                                                                                                SHA512

                                                                                                                                                ec51112a76772436f6f5c63d5a7a2878ec09ca613485087a7689c4036da8474d12784560a0319c910a4eba51097df3a0e27459c93fd57cccdf8790b7089c69fa

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                298KB

                                                                                                                                                MD5

                                                                                                                                                5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                SHA1

                                                                                                                                                1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                SHA256

                                                                                                                                                5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                SHA512

                                                                                                                                                58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\e518e3a2e94c015a5526e51f811bd86a\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                221KB

                                                                                                                                                MD5

                                                                                                                                                0644f2a7c68bcdc9b00deff550b27ce8

                                                                                                                                                SHA1

                                                                                                                                                6ffddbc157e7cb793874ed5ef308482ed732bac1

                                                                                                                                                SHA256

                                                                                                                                                2be42a20635266cf5d703a09df3e0b739a84508e4e6e78756f1690d5f9289596

                                                                                                                                                SHA512

                                                                                                                                                a5a532639a5d2e5e58e8a499dd4e26322ed82277b2c3d2189856a109496860edc1c4b4cf0ba6557b2168de25a4c6a92171db4386c6664a1325985746a7e43c92

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                43KB

                                                                                                                                                MD5

                                                                                                                                                dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                SHA1

                                                                                                                                                d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                SHA256

                                                                                                                                                f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                SHA512

                                                                                                                                                8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                124KB

                                                                                                                                                MD5

                                                                                                                                                929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                SHA1

                                                                                                                                                993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                SHA256

                                                                                                                                                2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                SHA512

                                                                                                                                                effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                MD5

                                                                                                                                                10b5a285eafccdd35390bb49861657e7

                                                                                                                                                SHA1

                                                                                                                                                62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                SHA256

                                                                                                                                                5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                SHA512

                                                                                                                                                19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                                Filesize

                                                                                                                                                88KB

                                                                                                                                                MD5

                                                                                                                                                1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                SHA1

                                                                                                                                                4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                SHA256

                                                                                                                                                9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                SHA512

                                                                                                                                                e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                Filesize

                                                                                                                                                648KB

                                                                                                                                                MD5

                                                                                                                                                0fa38f403ba09faf62e20b24695f337a

                                                                                                                                                SHA1

                                                                                                                                                be6b18e488d02a2b683b9f4a10c03d8be7fee6db

                                                                                                                                                SHA256

                                                                                                                                                0fdccd17c406389375f98026ae9e3e4f96864de32bef5403e153d2dd5de01488

                                                                                                                                                SHA512

                                                                                                                                                d8ac93601bf84cb0e302a82e372bc7f0f5668fef62e6c9c4d192aa1a716688ec8cd9742eda9c6da12da559673dd9f7039dd1fecf7ecdc5081a800012f2e46bcd

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                Filesize

                                                                                                                                                603KB

                                                                                                                                                MD5

                                                                                                                                                a17846284648eab865f2320e82534a0c

                                                                                                                                                SHA1

                                                                                                                                                ac3f4e18376162a72be4147d83f8819b82b912e4

                                                                                                                                                SHA256

                                                                                                                                                180af06b983dfffd3a9600b9d876fb3bb5e0ad125e2b223ac5906da23108f75b

                                                                                                                                                SHA512

                                                                                                                                                3c5109dc39fb2d698d40f7049be9905a195c09624507c30eba30b840e42e82e902dd971585f7a457c01ad5d213c7dcc25cbadecfa33e3f468987aa883b0d6068

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\System32\Locator.exe
                                                                                                                                                Filesize

                                                                                                                                                577KB

                                                                                                                                                MD5

                                                                                                                                                f1cf2514f44f0101ef0b7f8be1c624d5

                                                                                                                                                SHA1

                                                                                                                                                8fd09c93e3487a3870ae63e21ab5adeb98e3440a

                                                                                                                                                SHA256

                                                                                                                                                f95e435fcc5ee8e9d65f3f5b717fb85a7ce0fa95a54378c092ae02239e58fa78

                                                                                                                                                SHA512

                                                                                                                                                f8da4d26259d5acfa1be49f85cdcac31cfff9914b8f65bc638140629ac4ed5f30e7aebaba7eb8a93e707d576a3f8d15a08becf2f7c314bd7db5acf9c97e7e1ed

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\System32\alg.exe
                                                                                                                                                Filesize

                                                                                                                                                644KB

                                                                                                                                                MD5

                                                                                                                                                d127469ca48ae7721430d29237fdbe9a

                                                                                                                                                SHA1

                                                                                                                                                639add47437f8826c9a08ba446d31c43fc7df847

                                                                                                                                                SHA256

                                                                                                                                                e621269ca1f9402b678520412b1cea1709652a3be05664f54d149823ff573f6f

                                                                                                                                                SHA512

                                                                                                                                                98f34409be569503ca64c6177d7b53b39ec59ec32a895059df39e9e9eee5cafc35d0038bf3a752e2cc02aa2cabcd223a546cabf7ec09e0400e05c32ece344b8c

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\System32\ieetwcollector.exe
                                                                                                                                                Filesize

                                                                                                                                                674KB

                                                                                                                                                MD5

                                                                                                                                                e901a3148354d27467ebe28ef64dabad

                                                                                                                                                SHA1

                                                                                                                                                c4e30f524234b21701790fe9d335840e30bfd8eb

                                                                                                                                                SHA256

                                                                                                                                                52e132e03ac6fbf890cc02fd25311432452c0a8fe859a97b1587d409074843d8

                                                                                                                                                SHA512

                                                                                                                                                8f21efff0e814f7e24bdaab2a1964b2e289cfd62c0ae6f03453af1f02a182f92b95e0a30e9a7d5918044b0b651ec78c95a5c9d0b06a5ac0e82d4da69b877e04e

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\System32\msdtc.exe
                                                                                                                                                Filesize

                                                                                                                                                705KB

                                                                                                                                                MD5

                                                                                                                                                61e26be595be148edbaf64de2ab4fd5f

                                                                                                                                                SHA1

                                                                                                                                                1ac29490ff1e8289bcf3ab45cfe0671bd929ce45

                                                                                                                                                SHA256

                                                                                                                                                a4e5afe8b7eba364a6cf744c514175730235a5943b9fde299724bc968b011a3a

                                                                                                                                                SHA512

                                                                                                                                                687573451f9f9842ad514a11321d5475ff64c61f6116036570ee12b48a95257f0acb488c5129a1a32e72062751411d3f84d34a23b6d0717ff2157027fba8fb56

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\System32\msiexec.exe
                                                                                                                                                Filesize

                                                                                                                                                691KB

                                                                                                                                                MD5

                                                                                                                                                533564d5fc024d6e600fd43f21b2416d

                                                                                                                                                SHA1

                                                                                                                                                6141bb5050e00736e31fe742ebb6a09bf06539ab

                                                                                                                                                SHA256

                                                                                                                                                a213df398e410508c1c657eaf38b70c2bb40a006192612b6e67adb12761c172a

                                                                                                                                                SHA512

                                                                                                                                                36b1eece2e517f51c2eb73b123c32f28faf60790c60ed734759555b29b1c0d1b48e1242dd6bda2a104b509d4539f61b8a979aeaacf488c68ab0110ad4931ef39

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\System32\snmptrap.exe
                                                                                                                                                Filesize

                                                                                                                                                581KB

                                                                                                                                                MD5

                                                                                                                                                bbec37b435300030bda255f2de517d32

                                                                                                                                                SHA1

                                                                                                                                                a3f1b956592db2faca24d98059d2439cb92e8ad3

                                                                                                                                                SHA256

                                                                                                                                                9aaf512e4ee751b73da85eaa094d4d1a458736a835e462fba77dfb8898149b5f

                                                                                                                                                SHA512

                                                                                                                                                8385f7e35059b967d060c14b82753c66c7a0f218e19684b0f5b4e1f7f9524e86e319cfcbe4dcf57e87dfd66f1c371ac5e4029de05e79b036876588c6d46073f4

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\System32\wbengine.exe
                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                                MD5

                                                                                                                                                96c87ad906c2539bf134e623e4091cf2

                                                                                                                                                SHA1

                                                                                                                                                5699c355c6ceb6913efbf8dd530c3cef29a23db9

                                                                                                                                                SHA256

                                                                                                                                                15479712c1372701f66f92f5aaa5fe13469b5cf49fdf3f4f9c8c773d154f3e84

                                                                                                                                                SHA512

                                                                                                                                                34c1570d03cbebd7f2b42d7fa3421e8f791e0281d793329618623e174669144b735eab3a96e6053449aa70672e6d1036e8f32821f45afc5066a6ceded2270971

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\ehome\ehrecvr.exe
                                                                                                                                                Filesize

                                                                                                                                                1.2MB

                                                                                                                                                MD5

                                                                                                                                                f1db75a2deeda737542636027a933fb5

                                                                                                                                                SHA1

                                                                                                                                                a3df76c418043d26d69686551d878c3801e1dbf4

                                                                                                                                                SHA256

                                                                                                                                                81489b67e30e85b009fe29eae1143e97648009e43c457a87cd4560c4cc4e60fb

                                                                                                                                                SHA512

                                                                                                                                                707dfbbf31a53f0ecae5c01a15a72b183c4ecc4cb7825028d8055b8eaa049f41076bbb90e4008c182582ef9a34c47720d22ce22e3deead9a42c94254147ad851

                                                                                                                                                Download Submit

                                                                                                                                              • \Windows\ehome\ehsched.exe
                                                                                                                                                Filesize

                                                                                                                                                691KB

                                                                                                                                                MD5

                                                                                                                                                b93aac3d31c092a97168d2cc890a5fba

                                                                                                                                                SHA1

                                                                                                                                                6190a51986d630996bf0d0f386634ea9f6d932d6

                                                                                                                                                SHA256

                                                                                                                                                46da8e87a16f3d6ddddc0cc1ec7293c9e9d2580a72e9c4d95c2246d257633954

                                                                                                                                                SHA512

                                                                                                                                                e8e4d2395fd595c1f6c53bec9d3bd9a02f07d71228611185b64d600d3d29d67d510362c95adc985fe620dbb0e8a9c93b0de1de2ca25e4284370278f2c943b923

                                                                                                                                                Download Submit

                                                                                                                                              • memory/372-142-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/540-745-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/600-168-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                728KB

                                                                                                                                                Download

                                                                                                                                              • memory/600-270-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                728KB

                                                                                                                                                Download

                                                                                                                                              • memory/744-630-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                784KB

                                                                                                                                                Download

                                                                                                                                              • memory/744-294-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                784KB

                                                                                                                                                Download

                                                                                                                                              • memory/940-704-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/940-689-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1128-507-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1128-398-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1188-68-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1188-69-0x0000000000AC0000-0x0000000000B27000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                                Download

                                                                                                                                              • memory/1188-74-0x0000000000AC0000-0x0000000000B27000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                                Download

                                                                                                                                              • memory/1188-181-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1192-643-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1192-663-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1284-245-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                30.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/1284-154-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                30.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/1344-271-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/1344-523-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/1492-311-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                600KB

                                                                                                                                                Download

                                                                                                                                              • memory/1492-232-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                600KB

                                                                                                                                                Download

                                                                                                                                              • memory/1512-137-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.2MB

                                                                                                                                                Download

                                                                                                                                              • memory/1512-224-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.2MB

                                                                                                                                                Download

                                                                                                                                              • memory/1632-163-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                808KB

                                                                                                                                                Download

                                                                                                                                              • memory/1632-171-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                808KB

                                                                                                                                                Download

                                                                                                                                              • memory/1668-109-0x0000000000860000-0x00000000008C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/1668-102-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.2MB

                                                                                                                                                Download

                                                                                                                                              • memory/1668-103-0x0000000000860000-0x00000000008C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/1668-207-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.2MB

                                                                                                                                                Download

                                                                                                                                              • memory/1680-680-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1680-666-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1708-176-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                712KB

                                                                                                                                                Download

                                                                                                                                              • memory/1708-274-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                712KB

                                                                                                                                                Download

                                                                                                                                              • memory/1708-183-0x00000000004E0000-0x0000000000592000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                712KB

                                                                                                                                                Download

                                                                                                                                              • memory/1776-629-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1776-647-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1800-555-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/1800-275-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/1808-744-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1808-732-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1812-612-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1812-579-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1816-609-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1816-618-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/1964-290-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                                Download

                                                                                                                                              • memory/1964-608-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                                Download

                                                                                                                                              • memory/1968-707-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                712KB

                                                                                                                                                Download

                                                                                                                                              • memory/1968-219-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                712KB

                                                                                                                                                Download

                                                                                                                                              • memory/1968-121-0x0000000000370000-0x00000000003D0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/1968-114-0x0000000000370000-0x00000000003D0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/1968-120-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                712KB

                                                                                                                                                Download

                                                                                                                                              • memory/2020-741-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2020-755-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2036-277-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2036-347-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2064-692-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2064-675-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2104-288-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                724KB

                                                                                                                                                Download

                                                                                                                                              • memory/2104-187-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                724KB

                                                                                                                                                Download

                                                                                                                                              • memory/2156-321-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/2156-668-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/2204-723-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2204-720-0x0000000001AE0000-0x0000000001B9A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                744KB

                                                                                                                                                Download

                                                                                                                                              • memory/2204-714-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2212-101-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/2212-8-0x0000000000250000-0x00000000002B7000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                                Download

                                                                                                                                              • memory/2212-0-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/2212-2-0x0000000000250000-0x00000000002B7000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                                Download

                                                                                                                                              • memory/2216-307-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                                Download

                                                                                                                                              • memory/2216-642-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                                Download

                                                                                                                                              • memory/2372-38-0x0000000000600000-0x0000000000667000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                                Download

                                                                                                                                              • memory/2372-31-0x0000000000600000-0x0000000000667000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                                Download

                                                                                                                                              • memory/2372-30-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                636KB

                                                                                                                                                Download

                                                                                                                                              • memory/2372-66-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                636KB

                                                                                                                                                Download

                                                                                                                                              • memory/2388-255-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/2388-269-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/2412-48-0x0000000000450000-0x00000000004B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/2412-78-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                668KB

                                                                                                                                                Download

                                                                                                                                              • memory/2412-54-0x0000000000450000-0x00000000004B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/2412-46-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                668KB

                                                                                                                                                Download

                                                                                                                                              • memory/2416-764-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2460-134-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                656KB

                                                                                                                                                Download

                                                                                                                                              • memory/2460-13-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                656KB

                                                                                                                                                Download

                                                                                                                                              • memory/2480-208-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2480-293-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2496-699-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2496-719-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2580-17-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                628KB

                                                                                                                                                Download

                                                                                                                                              • memory/2580-18-0x0000000000DF0000-0x0000000000E50000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/2580-26-0x0000000000DF0000-0x0000000000E50000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/2580-141-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                628KB

                                                                                                                                                Download

                                                                                                                                              • memory/2616-220-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/2616-262-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/2660-525-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2660-499-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2668-339-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2668-392-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2692-91-0x0000000000520000-0x0000000000580000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/2692-84-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/2692-186-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/2692-85-0x0000000000520000-0x0000000000580000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                                Download

                                                                                                                                              • memory/2764-258-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                600KB

                                                                                                                                                Download

                                                                                                                                              • memory/2764-497-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                600KB

                                                                                                                                                Download

                                                                                                                                              • memory/2784-246-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                596KB

                                                                                                                                                Download

                                                                                                                                              • memory/2788-524-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2788-560-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2988-589-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download

                                                                                                                                              • memory/2988-558-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                672KB

                                                                                                                                                Download