Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe
Resource
win7-20240221-en
General
-
Target
4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe
-
Size
625KB
-
MD5
4f1d8a628ac8682fdf0c2e9500d1a2d0
-
SHA1
99e1fe9fb55de0b61be2bc1b9fafaeebacb87a60
-
SHA256
136dffe5b76e21a6b6f18ff04bb31ac24ba9355e3a8960824d895e71f0401487
-
SHA512
6f8df29892aed6ca4e2b7d5c06f58a6c0f4ba4b526de6e07879029ce31a425158af7e920ea7e8b375474d0547d4946ae98e4069e873b793b392b93598db2e502
-
SSDEEP
12288:b2CGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPhS:KFt/sBlDqgZQd6XKtiMJYiPUS
Malware Config
Signatures
-
Executes dropped EXE 52 IoCs
pid Process 468 Process not Found 2368 alg.exe 1968 aspnet_state.exe 2004 mscorsvw.exe 516 mscorsvw.exe 2616 mscorsvw.exe 2876 mscorsvw.exe 2692 ehRecvr.exe 1836 ehsched.exe 2976 elevation_service.exe 1688 IEEtwCollector.exe 2304 GROOVE.EXE 1728 maintenanceservice.exe 1764 msdtc.exe 1036 msiexec.exe 1288 OSE.EXE 1520 OSPPSVC.EXE 2484 perfhost.exe 1848 locator.exe 1944 snmptrap.exe 2952 vds.exe 2820 mscorsvw.exe 2148 vssvc.exe 2696 wbengine.exe 560 WmiApSrv.exe 2632 wmpnetwk.exe 1896 SearchIndexer.exe 864 mscorsvw.exe 2348 mscorsvw.exe 1468 mscorsvw.exe 1712 mscorsvw.exe 2244 mscorsvw.exe 864 mscorsvw.exe 1496 mscorsvw.exe 1784 mscorsvw.exe 2532 mscorsvw.exe 2924 mscorsvw.exe 2704 mscorsvw.exe 2572 mscorsvw.exe 772 mscorsvw.exe 1660 mscorsvw.exe 940 mscorsvw.exe 864 dllhost.exe 1888 mscorsvw.exe 2492 mscorsvw.exe 1660 mscorsvw.exe 2824 mscorsvw.exe 1060 mscorsvw.exe 1664 mscorsvw.exe 1748 mscorsvw.exe 1888 mscorsvw.exe 2796 mscorsvw.exe -
Loads dropped DLL 15 IoCs
pid Process 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 1036 msiexec.exe 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 760 Process not Found 468 Process not Found -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\System32\snmptrap.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\vssvc.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\dllhost.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\System32\msdtc.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\locator.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\wbengine.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2adb6e8dae4ef42b.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\msiexec.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\System32\vds.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe aspnet_state.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe aspnet_state.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe aspnet_state.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe -
Drops file in Windows directory 38 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe aspnet_state.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe aspnet_state.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{D0F3CA71-B8CB-4C64-9FE3-22584DF3C1B3}.crmlog dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{D0F3CA71-B8CB-4C64-9FE3-22584DF3C1B3}.crmlog dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe alg.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe aspnet_state.exe File opened for modification C:\Windows\ehome\ehsched.exe aspnet_state.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe alg.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe aspnet_state.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501 = "Connect to a Network Projector" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-104 = "Jellyfish" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040c43ddb24a0da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\msconfig.exe,-1601 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10055 = "FreeCell" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ wmpnetwk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505 = "Sticky Notes" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310 = "Data Sources (ODBC)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\System\wab32res.dll,-4602 = "Contact file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4 = "Windows Media Player" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{A76D2474-DDA4-4293-B357-EF5F713263D2} wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555 = "Windows Speech Recognition" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0ef79d524a0da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\syncCenter.dll,-3001 = "Sync files between your computer and network folders" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\SoundRecorder.exe,-32790 = "Record sound and save it on your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\sud.dll,-1 = "Default Programs" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\Explorer.exe,-312 = "Play and manage games on your computer." SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health wmpnetwk.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080a421d724a0da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Defragments your disks so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Firewall with Advanced Security" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\rstrui.exe,-100 = "System Restore" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\mblctr.exe,-1004 = "Opens the Windows Mobility Center so you can adjust display brightness, volume, power options, and other mobile PC settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\wucltux.dll,-2 = "Delivers software updates and drivers, and provides automatic updating options." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Disk Defragmenter" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\mip.exe,-292 = "Math Input Panel" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10082 = "Games Explorer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10061 = "Spider Solitaire" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10059 = "Mahjong Titans" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10060 = "Solitaire" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\XpsRchVw.exe,-103 = "View, digitally sign, and set permissions for XPS documents" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000802272db24a0da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\ShapeCollector.exe,-299 = "Provide writing samples to help improve the recognition of your handwriting." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-113 = "Windows PowerShell Integrated Scripting Environment. Performs object-based (command-line) functions" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-118 = "Sleep Away" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10209 = "More Games from Microsoft" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2804 ehRec.exe 1968 aspnet_state.exe 1968 aspnet_state.exe 1968 aspnet_state.exe 1968 aspnet_state.exe 1968 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2228 4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: 33 3004 EhTray.exe Token: SeIncBasePriorityPrivilege 3004 EhTray.exe Token: SeDebugPrivilege 2804 ehRec.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe Token: SeSecurityPrivilege 1036 msiexec.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: 33 3004 EhTray.exe Token: SeIncBasePriorityPrivilege 3004 EhTray.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: SeBackupPrivilege 2148 vssvc.exe Token: SeRestorePrivilege 2148 vssvc.exe Token: SeAuditPrivilege 2148 vssvc.exe Token: SeBackupPrivilege 2696 wbengine.exe Token: SeRestorePrivilege 2696 wbengine.exe Token: SeSecurityPrivilege 2696 wbengine.exe Token: SeManageVolumePrivilege 1896 SearchIndexer.exe Token: 33 2632 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2632 wmpnetwk.exe Token: 33 1896 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1896 SearchIndexer.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: SeDebugPrivilege 2368 alg.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: SeDebugPrivilege 1968 aspnet_state.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2616 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe Token: SeShutdownPrivilege 2876 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3004 EhTray.exe 3004 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3004 EhTray.exe 3004 EhTray.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 2196 SearchProtocolHost.exe 2196 SearchProtocolHost.exe 2196 SearchProtocolHost.exe 2196 SearchProtocolHost.exe 2196 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 1736 SearchProtocolHost.exe 2196 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2820 2616 mscorsvw.exe 52 PID 2616 wrote to memory of 2820 2616 mscorsvw.exe 52 PID 2616 wrote to memory of 2820 2616 mscorsvw.exe 52 PID 2616 wrote to memory of 2820 2616 mscorsvw.exe 52 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 2348 2616 mscorsvw.exe 59 PID 2616 wrote to memory of 2348 2616 mscorsvw.exe 59 PID 2616 wrote to memory of 2348 2616 mscorsvw.exe 59 PID 2616 wrote to memory of 2348 2616 mscorsvw.exe 59 PID 1896 wrote to memory of 2196 1896 SearchIndexer.exe 60 PID 1896 wrote to memory of 2196 1896 SearchIndexer.exe 60 PID 1896 wrote to memory of 2196 1896 SearchIndexer.exe 60 PID 1896 wrote to memory of 2880 1896 SearchIndexer.exe 61 PID 1896 wrote to memory of 2880 1896 SearchIndexer.exe 61 PID 1896 wrote to memory of 2880 1896 SearchIndexer.exe 61 PID 2616 wrote to memory of 1468 2616 mscorsvw.exe 62 PID 2616 wrote to memory of 1468 2616 mscorsvw.exe 62 PID 2616 wrote to memory of 1468 2616 mscorsvw.exe 62 PID 2616 wrote to memory of 1468 2616 mscorsvw.exe 62 PID 2616 wrote to memory of 1712 2616 mscorsvw.exe 63 PID 2616 wrote to memory of 1712 2616 mscorsvw.exe 63 PID 2616 wrote to memory of 1712 2616 mscorsvw.exe 63 PID 2616 wrote to memory of 1712 2616 mscorsvw.exe 63 PID 2616 wrote to memory of 2244 2616 mscorsvw.exe 64 PID 2616 wrote to memory of 2244 2616 mscorsvw.exe 64 PID 2616 wrote to memory of 2244 2616 mscorsvw.exe 64 PID 2616 wrote to memory of 2244 2616 mscorsvw.exe 64 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 864 2616 mscorsvw.exe 75 PID 2616 wrote to memory of 1496 2616 mscorsvw.exe 66 PID 2616 wrote to memory of 1496 2616 mscorsvw.exe 66 PID 2616 wrote to memory of 1496 2616 mscorsvw.exe 66 PID 2616 wrote to memory of 1496 2616 mscorsvw.exe 66 PID 2616 wrote to memory of 1784 2616 mscorsvw.exe 67 PID 2616 wrote to memory of 1784 2616 mscorsvw.exe 67 PID 2616 wrote to memory of 1784 2616 mscorsvw.exe 67 PID 2616 wrote to memory of 1784 2616 mscorsvw.exe 67 PID 2616 wrote to memory of 2532 2616 mscorsvw.exe 68 PID 2616 wrote to memory of 2532 2616 mscorsvw.exe 68 PID 2616 wrote to memory of 2532 2616 mscorsvw.exe 68 PID 2616 wrote to memory of 2532 2616 mscorsvw.exe 68 PID 2616 wrote to memory of 2924 2616 mscorsvw.exe 69 PID 2616 wrote to memory of 2924 2616 mscorsvw.exe 69 PID 2616 wrote to memory of 2924 2616 mscorsvw.exe 69 PID 2616 wrote to memory of 2924 2616 mscorsvw.exe 69 PID 2616 wrote to memory of 2704 2616 mscorsvw.exe 70 PID 2616 wrote to memory of 2704 2616 mscorsvw.exe 70 PID 2616 wrote to memory of 2704 2616 mscorsvw.exe 70 PID 2616 wrote to memory of 2704 2616 mscorsvw.exe 70 PID 2616 wrote to memory of 2572 2616 mscorsvw.exe 71 PID 2616 wrote to memory of 2572 2616 mscorsvw.exe 71 PID 2616 wrote to memory of 2572 2616 mscorsvw.exe 71 PID 2616 wrote to memory of 2572 2616 mscorsvw.exe 71 PID 2616 wrote to memory of 772 2616 mscorsvw.exe 72 PID 2616 wrote to memory of 772 2616 mscorsvw.exe 72 PID 2616 wrote to memory of 772 2616 mscorsvw.exe 72 PID 2616 wrote to memory of 772 2616 mscorsvw.exe 72 PID 2616 wrote to memory of 1660 2616 mscorsvw.exe 79 PID 2616 wrote to memory of 1660 2616 mscorsvw.exe 79 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\4f1d8a628ac8682fdf0c2e9500d1a2d0_NEAS.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2004
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:516
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2820
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d4 -NGENProcess 250 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2348
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1d4 -NGENProcess 240 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 250 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1712
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 250 -NGENProcess 254 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 24c -NGENProcess 234 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1f0 -NGENProcess 248 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 268 -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 234 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2532
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 248 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2924
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 254 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2704
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 234 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 248 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 254 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 274 -NGENProcess 234 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:940
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 234 -NGENProcess 278 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 270 -NGENProcess 26c -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 270 -NGENProcess 234 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 248 -NGENProcess 26c -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 298 -NGENProcess 274 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1060
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 234 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 26c -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 284 -NGENProcess 1d4 -Pipe 288 -Comment "NGen Worker Process"2⤵PID:1632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 214 -NGENProcess 1f0 -Pipe 1e8 -Comment "NGen Worker Process"2⤵PID:1600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 1c4 -NGENProcess 238 -Pipe 244 -Comment "NGen Worker Process"2⤵PID:1532
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 238 -NGENProcess 28c -Pipe 26c -Comment "NGen Worker Process"2⤵PID:464
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 260 -NGENProcess 1d0 -Pipe 254 -Comment "NGen Worker Process"2⤵PID:2360
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 248 -NGENProcess 1d0 -Pipe 1f0 -Comment "NGen Worker Process"2⤵PID:888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 274 -NGENProcess 284 -Pipe 1d8 -Comment "NGen Worker Process"2⤵PID:2516
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 284 -NGENProcess 260 -Pipe 298 -Comment "NGen Worker Process"2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a0 -NGENProcess 1d0 -Pipe 214 -Comment "NGen Worker Process"2⤵PID:2904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 1d0 -NGENProcess 274 -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:2164
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 2a4 -NGENProcess 260 -Pipe 248 -Comment "NGen Worker Process"2⤵PID:2808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 260 -NGENProcess 2a0 -Pipe 29c -Comment "NGen Worker Process"2⤵PID:268
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 234 -NGENProcess 274 -Pipe 284 -Comment "NGen Worker Process"2⤵PID:1432
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 274 -NGENProcess 2a4 -Pipe 278 -Comment "NGen Worker Process"2⤵PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 290 -NGENProcess 2a0 -Pipe 1d0 -Comment "NGen Worker Process"2⤵PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2a0 -NGENProcess 234 -Pipe 270 -Comment "NGen Worker Process"2⤵PID:2356
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2b0 -NGENProcess 290 -Pipe 260 -Comment "NGen Worker Process"2⤵PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 290 -NGENProcess 2a4 -Pipe 2ac -Comment "NGen Worker Process"2⤵PID:2088
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2b8 -NGENProcess 234 -Pipe 274 -Comment "NGen Worker Process"2⤵PID:2436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 234 -NGENProcess 2b0 -Pipe 28c -Comment "NGen Worker Process"2⤵PID:1816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 2c0 -NGENProcess 2a4 -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a4 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"2⤵PID:2932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 290 -Comment "NGen Worker Process"2⤵PID:2236
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2a4 -Comment "NGen Worker Process"2⤵PID:1044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 1c4 -NGENProcess 2b0 -Pipe 234 -Comment "NGen Worker Process"2⤵PID:2540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 2b0 -NGENProcess 2cc -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:1808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d8 -NGENProcess 2d0 -Pipe 2b4 -Comment "NGen Worker Process"2⤵PID:2144
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2d0 -NGENProcess 1c4 -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:2404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2e0 -NGENProcess 2cc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2cc -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:1264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2e8 -NGENProcess 1c4 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:2492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 1c4 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:3020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:1468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:2540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 1c4 -Comment "NGen Worker Process"2⤵PID:2196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 300 -NGENProcess 2e0 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 1d4 -NGENProcess 2e8 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:2520
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 1d4 -NGENProcess 300 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:3056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 300 -NGENProcess 2c4 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:2920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2c4 -NGENProcess 308 -Pipe 304 -Comment "NGen Worker Process"2⤵PID:1452
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 318 -NGENProcess 2b8 -Pipe 310 -Comment "NGen Worker Process"2⤵PID:936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 314 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:1732
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 308 -Pipe 1d4 -Comment "NGen Worker Process"2⤵PID:1304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2b8 -Pipe 2f0 -Comment "NGen Worker Process"2⤵PID:272
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 314 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:1604
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 308 -Pipe 2c4 -Comment "NGen Worker Process"2⤵PID:2104
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2b8 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:3008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 314 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:1116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 308 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:1844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2b8 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:2404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 314 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:2196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 308 -Pipe 32c -Comment "NGen Worker Process"2⤵PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2b8 -Pipe 330 -Comment "NGen Worker Process"2⤵PID:1372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 314 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:2308
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 308 -Pipe 338 -Comment "NGen Worker Process"2⤵PID:2104
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 354 -NGENProcess 348 -Pipe 350 -Comment "NGen Worker Process"2⤵PID:1532
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 33c -NGENProcess 308 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:2864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 35c -NGENProcess 34c -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:944
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 348 -Pipe 358 -Comment "NGen Worker Process"2⤵PID:2236
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 308 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:2216
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 34c -Pipe 344 -Comment "NGen Worker Process"2⤵PID:3060
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 348 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:1688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 308 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:1604
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 34c -Pipe 35c -Comment "NGen Worker Process"2⤵PID:2504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 348 -Pipe 360 -Comment "NGen Worker Process"2⤵PID:1808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 308 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:2252
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 308 -NGENProcess 37c -Pipe 380 -Comment "NGen Worker Process"2⤵PID:2084
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 384 -NGENProcess 348 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:2216
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 368 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 38c -NGENProcess 308 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:1156
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 374 -NGENProcess 368 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:1116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 394 -NGENProcess 384 -Pipe 314 -Comment "NGen Worker Process"2⤵PID:2600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 308 -Pipe 390 -Comment "NGen Worker Process"2⤵PID:2144
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 368 -Pipe 37c -Comment "NGen Worker Process"2⤵PID:524
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 384 -Pipe 378 -Comment "NGen Worker Process"2⤵PID:2652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 384 -NGENProcess 398 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:1328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 3a8 -NGENProcess 368 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:2588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 368 -NGENProcess 3a0 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 3b0 -NGENProcess 398 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:2176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 398 -NGENProcess 3a8 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:2160
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 3b8 -NGENProcess 3a0 -Pipe 384 -Comment "NGen Worker Process"2⤵PID:2936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3b4 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:2708
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3b4 -NGENProcess 398 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:3000
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3c4 -NGENProcess 3a0 -Pipe 38c -Comment "NGen Worker Process"2⤵PID:2548
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3c0 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:2212
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 398 -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3a0 -Pipe 368 -Comment "NGen Worker Process"2⤵PID:2044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3c0 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:2996
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 398 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:3064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3a0 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:2316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 3c0 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:2004
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 398 -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:2016
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e0 -NGENProcess 11c -Pipe 398 -Comment "NGen Worker Process"2⤵PID:1096
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 3a0 -NGENProcess 3d4 -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:2600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3d8 -NGENProcess 11c -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:464
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3ec -NGENProcess 3e0 -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 3d4 -Pipe 120 -Comment "NGen Worker Process"2⤵PID:2492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 11c -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:1152
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 3e0 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:1796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 3d4 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:2004
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 404 -NGENProcess 11c -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:1668
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 3fc -NGENProcess 404 -Pipe 3f4 -Comment "NGen Worker Process"2⤵PID:2440
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 404 -NGENProcess 3e0 -Pipe 11c -Comment "NGen Worker Process"2⤵PID:1960
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 410 -NGENProcess 3f8 -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:2308
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3f8 -NGENProcess 3fc -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:1468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 418 -NGENProcess 3e0 -Pipe 408 -Comment "NGen Worker Process"2⤵PID:2316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 414 -Pipe 3f0 -Comment "NGen Worker Process"2⤵PID:2576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 3fc -Pipe 404 -Comment "NGen Worker Process"2⤵PID:940
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 3e0 -Pipe 40c -Comment "NGen Worker Process"2⤵PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 414 -Pipe 410 -Comment "NGen Worker Process"2⤵PID:2600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 414 -NGENProcess 420 -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:1840
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 430 -NGENProcess 3e0 -Pipe 418 -Comment "NGen Worker Process"2⤵PID:968
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 3e0 -NGENProcess 428 -Pipe 42c -Comment "NGen Worker Process"2⤵PID:2836
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 438 -NGENProcess 420 -Pipe 424 -Comment "NGen Worker Process"2⤵PID:2220
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 434 -Pipe 3f8 -Comment "NGen Worker Process"2⤵PID:1828
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 428 -Pipe 414 -Comment "NGen Worker Process"2⤵PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 428 -NGENProcess 438 -Pipe 420 -Comment "NGen Worker Process"2⤵PID:2712
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 448 -NGENProcess 434 -Pipe 430 -Comment "NGen Worker Process"2⤵PID:2440
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 434 -NGENProcess 440 -Pipe 444 -Comment "NGen Worker Process"2⤵PID:2960
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 450 -NGENProcess 438 -Pipe 43c -Comment "NGen Worker Process"2⤵PID:1604
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 454 -NGENProcess 44c -Pipe 41c -Comment "NGen Worker Process"2⤵PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 44c -NGENProcess 434 -Pipe 440 -Comment "NGen Worker Process"2⤵PID:2296
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 434 -NGENProcess 44c -Pipe 45c -Comment "NGen Worker Process"2⤵PID:2232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 44c -NGENProcess 438 -Pipe 458 -Comment "NGen Worker Process"2⤵PID:464
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 464 -NGENProcess 3e0 -Pipe 450 -Comment "NGen Worker Process"2⤵PID:928
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 464 -NGENProcess 44c -Pipe 460 -Comment "NGen Worker Process"2⤵PID:1960
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 428 -NGENProcess 3e0 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:1468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 3e0 -NGENProcess 448 -Pipe 474 -Comment "NGen Worker Process"2⤵PID:2428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 448 -NGENProcess 468 -Pipe 470 -Comment "NGen Worker Process"2⤵PID:2132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 478 -NGENProcess 464 -Pipe 438 -Comment "NGen Worker Process"2⤵PID:2984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 47c -NGENProcess 3d4 -Pipe 434 -Comment "NGen Worker Process"2⤵PID:2436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 480 -NGENProcess 468 -Pipe 428 -Comment "NGen Worker Process"2⤵PID:2600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 468 -NGENProcess 1b4 -Pipe 484 -Comment "NGen Worker Process"2⤵PID:3036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 1b4 -NGENProcess 478 -Pipe 46c -Comment "NGen Worker Process"2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 488 -NGENProcess 47c -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:2532
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 468 -NGENProcess 490 -Pipe 1b4 -Comment "NGen Worker Process"2⤵PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 490 -NGENProcess 3e0 -Pipe 47c -Comment "NGen Worker Process"2⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 494 -NGENProcess 488 -Pipe 448 -Comment "NGen Worker Process"2⤵PID:1748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 498 -NGENProcess 464 -Pipe 1b4 -Comment "NGen Worker Process"2⤵PID:1632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 49c -NGENProcess 3e0 -Pipe 48c -Comment "NGen Worker Process"2⤵PID:1980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4a0 -NGENProcess 488 -Pipe 480 -Comment "NGen Worker Process"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4a4 -NGENProcess 498 -Pipe 494 -Comment "NGen Worker Process"2⤵PID:2828
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 468 -NGENProcess 488 -Pipe 490 -Comment "NGen Worker Process"2⤵PID:2116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 4ac -NGENProcess 49c -Pipe 478 -Comment "NGen Worker Process"2⤵PID:1044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 498 -Pipe 4a8 -Comment "NGen Worker Process"2⤵PID:2356
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 498 -NGENProcess 4a4 -Pipe 4b8 -Comment "NGen Worker Process"2⤵PID:2816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 464 -NGENProcess 4b4 -Pipe 4a0 -Comment "NGen Worker Process"2⤵PID:2056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 4bc -NGENProcess 4ac -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:3060
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4c0 -NGENProcess 4a4 -Pipe 488 -Comment "NGen Worker Process"2⤵PID:2232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 4a4 -NGENProcess 4b0 -Pipe 468 -Comment "NGen Worker Process"2⤵PID:2064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 504 -NGENProcess 508 -Pipe 510 -Comment "NGen Worker Process"2⤵PID:3064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 530 -NGENProcess 51c -Pipe 52c -Comment "NGen Worker Process"2⤵PID:1692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 528 -NGENProcess 524 -Pipe 518 -Comment "NGen Worker Process"2⤵PID:772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 534 -NGENProcess 500 -Pipe 520 -Comment "NGen Worker Process"2⤵PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 538 -NGENProcess 51c -Pipe 50c -Comment "NGen Worker Process"2⤵PID:2516
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 53c -NGENProcess 524 -Pipe 514 -Comment "NGen Worker Process"2⤵PID:1748
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2876 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2796
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2692
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:1836
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3004
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2976
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:1688
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2304
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1728
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1764
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1288
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:1520
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2484
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1848
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1944
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2952
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:560
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:2196
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵
- Modifies data under HKEY_USERS
PID:2880
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD567745ec8c0c7fbc9a3ac778096572f03
SHA10b11db1e83ccae441c00c3543d8b69f6dd4810ad
SHA25639992fd44b205efb25c4ec57f4923693628d6dace8eee99d18917519b1296361
SHA51293472a16895270b2745f7aeea11b0549a19c953d8978445ebe8fa633abfe9c3f03402a56c8af8777d832766a2e0bf10510392c1b8fcefe3e19f0f21d80ab5d17
-
Filesize
1.2MB
MD5dc8babdb6fb4da1b8a5a0d7ce6515ec2
SHA1af5494a90f349d9c06384d5e813d2d381a772380
SHA25649a9eaf5d36d1a7eb21bba5d46996f314fe0e793b4a4e9f4a51beb3c6d5565cf
SHA5126a22d94744a98a958665dca7d243c013d806752929b21b60d22449a23c5d7bad481ac6c01f3cbfb81c6d52604aac0246ebad1bfb85592e417d3dca751642d0e8
-
Filesize
781KB
MD5ab4de7c0625bafa5b1dbe4e7506ad971
SHA15776c94d8102cd0ab9e659b58f965abab866bd22
SHA256d2927e5c2a61cfd4690be52d755e14eb1b70653961d770b1a222d1658330b48a
SHA51202b407137c1215286828a7dbece818707ff2458e2a0a1edb88551c661df0d332833a41f979f6b258579bbbdf201b53f882064c70c2c3e476a08cb42d8dc7efee
-
Filesize
448KB
MD5548342e167f11e7c5e1334c82f58a75a
SHA113ef10ed8ad6ea8f0a29248311356cc26733632b
SHA256b6f9d0bb764a043afb82f15984803dcf9de597650befb04b0688a4ad09926b84
SHA512951f8a410f60482b54b7e90c2ab2d0c4cd429446214e2fb5894c464897c17a43d19d7008f242e95f1089257cd6500a9ae9039afa2f97ec9133afa084653d1f5e
-
Filesize
2.1MB
MD54b03a65c6cb16b0d72fde90d7ca29474
SHA10d55471f90eb5d17c8341514a3a595360e528ddf
SHA256bdd435c8015cdfb42899b9f7b7ae6c7e31edc5f4e5b1c9dceb57dc2f24db467d
SHA5126557d2841039160645c6d51cde70d530376fadce9a4d83d0773625757d0a0ef2e542a973eb2d0671ad63efd8d79352deae7383b904e26b38e51093d58acea313
-
Filesize
448KB
MD5115cc9cddff7dcd0c58458abaa21f04a
SHA1f409143b2e63810c2c82c504cea4ec581f75c2f0
SHA25649fba7c57fc2d580726b278653729e831a37bfe309cb201c459e9dbfb4386292
SHA512db2560e36d1ceed7af30c975cb7173b0d2ee3b7b72d23ddb2dea97969e9dc301450617e8cce2c8c367a282f2d8ccf5f7bb990c5aaf22bc789fdecadb91f30ee1
-
Filesize
448KB
MD52021f5b817be4c5757fc4e66f70f936e
SHA182b891dd722c17a77c4044483be43b745902d80e
SHA2565ed6d2640d66ffc7d4656228457e7c48c98ec147b1bb62b14d7b31718b460ad8
SHA5120a4cbd20241d8624b5128e0aaf9a985c069e4b3e88d39819340a533c9e9f408e94521e38eccf574911fa0046a48acbeef22bdd93760e284e2ed920bcc4a00e6c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
648KB
MD5bb2ea0e0a139594461de139bfde98995
SHA1feb0579360c6f9901d32e4492df26a0db9c34d33
SHA2563fbaedc3909b428de791aea86321007f4790dd7d16375b31d3e5020eaf0e5b77
SHA512c791b54dbf9a42c4e71fddc12aa7d6ded056b9d6bd8f89aac216d998588e3fe1d256fe8fa6a509989205a489891580e64a64296b47081f3f4e70cff33d96d064
-
Filesize
872KB
MD58acf148c9eafa3436e6b73ff4df95f2f
SHA1de50449d37ec8e765bded980923267b5b533d968
SHA2567044d49bbbea6cef23ba618cb0ac63cc26f756e9038968f0d7e1552961f6c866
SHA5120f570c44b8f773ca164a93170ddcae449c1955c7406722be5442598d8e2f8f2a052d5838e2b80196419ca41f5944447e6477360e40023b403baff3d89f956fe8
-
Filesize
603KB
MD51f7d566d438babfba0e3559cff5b82a7
SHA1bf1fd68c1afdff292b5835071adedd071a6b43f3
SHA2561fa669960d7ff6357b810bd1899ab517f7b70fc963d91a35970dfe7a5de57a5a
SHA5129390574c48337ba01209b5115155925f2d28d722fd601a88695eaed68d0a41733c4e2c818e81c85d765e47fc66c99e8e40fe66008117dc52454b24d6b78393b3
-
Filesize
678KB
MD5ca4aebd487fd20f30e9a7cf7262bca74
SHA14e35ebbc942fabdfa826c26b4be59dc27b8da873
SHA2567e8d558c871e8968d2bce01a72f8e6ebbb5beb35cdf19ca1c084d4fc48a356eb
SHA51248e62d56b00f661da8995d352b2503dd97ce97086326899f51bada1437d3bb06da0927baf2fe32e2fce3e4ccda63e9933ece93ecebd3b1627efe478ac653cf8c
-
Filesize
625KB
MD5463cc9578b4b19f5e92d109a3e50b9bb
SHA1fd19f42078eef62df9c05efd157b535402a62cd5
SHA2566da96d44eb4fba84a9d39317f01044d06e3fb59ea23b259d235927b794d6ba33
SHA5129375babaf2ace7959a7822a53816cfc60f1479e1585cce19466034c4ad4c1cc353a4d1ad4014854a1197cb361c72311e0921b22f84482243d9bd013ba34e1e77
-
Filesize
1003KB
MD50699798db6069d42487360b405556b34
SHA184a75a8ed0d651bd350cadf15492653cf02ef02b
SHA2565b31c7087753a9a3ed33e5545f40c727d459615df3a525065a1613a7c6704e66
SHA51276cce917e9718717a4a00e4a20fc9232065d9cc0d445e9c065d39a0c5c904038e5e092f156cd99161cdd1b8b0a69368988d629a675f49ad9daed3dde407d8a39
-
Filesize
448KB
MD542056ee9eff709bfd79ccbfab02c40d8
SHA12b88d391cc73606121dfbfb133fd54dd5776e45c
SHA256e028d20f0279c223f4ee71083e306f405edd182db3b43c3a31ecdaaf5765556d
SHA512ca35909160f214424b63b28cc6c6efd41d789e593942bed3e1e716381f837e41d25b446bda649d963896a45f97da75802bca2d806048a99e9832682e775b70bb
-
Filesize
640KB
MD502d2f84d5638acf5fd2141a8abc130fc
SHA1454cb78ca20912d436843b75a0adfea91e53cef0
SHA2564a4693e5f9797540428c2476372415ebde1509020656d958d1e55b1035a55de1
SHA512b365bcfaa50cf09e44561ea351889a40b41c21a05b50e1a76eca40349176cb05f78c223c8927e7151f40da83a6393fb5317e60dcae1746d101e69bdc532e15cb
-
Filesize
576KB
MD5118a8638c4d631435312280fdbc3aa15
SHA1d01c3ebd1d9980ec3fea1082d5c37f0ab974565d
SHA256a084610739f46b727efe9db825c11d44eaadac060effc0dd646c3645f5ca3f3a
SHA512acc71707111b736db0703f726bdeb32236c6a9125f8853833d0b489348cb23781f8e7fe58969b7800dfdc3d83c054794b027e032b82761efd9f8a21e83f11ce2
-
Filesize
656KB
MD5af2325de11f1029d869a1631be40a269
SHA16d8e4be8123b11760ad7473ecc868252376e60fa
SHA2561f73cc4f4ee3b2f4dfc3649e4de96a0b0a472e01b60f97437b8077f28037a974
SHA5124f0b7a7f9ff37b6434cf061b9f51c667d57bf16b2cdf0bbcc437cac518436ff0f941f0c54a3e688745e6674a9a8bbddd35d64cb51023cd6170bb1b3e9d13e22d
-
Filesize
8KB
MD5edec87a0edf2f784550c76dedcebf8ef
SHA144c29c40cdfc7d677894bc8da0a2e396a7c69fa6
SHA256bbe37db279cdaec013df0d0c2018639c910282e7d212fe2ad98dc648b0523c15
SHA5124bb682fbe98500f7da15d33b330b0f1c3b59472423449d918c242bce4912b78214861b3e414bb9398a906092c387b9a28a3e982ccca8b807b292357c98d21b71
-
Filesize
587KB
MD54f10b73a72380b0063b2b1b3bb06fe4e
SHA1b7e5ba8b36f93181679fecf3d6d7bbde472a01c5
SHA2563408cb614ba4244fd4fdd849d5a2ab624ec4110a07dc86773e87f3e0f6fd6d6e
SHA5127aa7ae7f705818669cc2e13b2cd14e888f29628375ed58c68ea71df3ebcfc6057c060bfe92c6576797b9e2ce4424751b109f962af75eabd850cbeb078a3d6536
-
Filesize
577KB
MD549f3a18ea8682b9a1908dfcdcd8ff5fd
SHA155a608c3ffeb7b34c2c697213661ee7dcd9284be
SHA25652202809e323aafdb671af04cb023d53fc1cf596f2b2800fef27053622596397
SHA51255dd7f81f526d9b35f4d991045eafa10acf930c36007d6b64137f0f01424f66431ec4368db3340d25151f079b46effbe5a9c20e31747ad8b0819ebbefca90acf
-
Filesize
448KB
MD5080c605dd0fd6455bf77c41d17c9f400
SHA1c09c67682e46a4b6c3e0964c3a8e66ad61bbeb8b
SHA256a9fea4abac13dd1559fba5335d4754a7177cf8b68b58f1f16f5cafbba1e627ae
SHA512af692655c895ad496787d44590b6ec2d18034d887063685bd9b5c462f4d618d5978f323c2739e8c62e168d4c7b3f975ade8e809f7feaae1ba72b22aa1b406a88
-
Filesize
448KB
MD532d5ae93ce8f3062109592ccf938a5d8
SHA1a0735485a3fe4b6658f214f41ae7f51f3dbd3635
SHA25690f3fe66438c470b66650f26a46f7f8064411781263461aa8f76b529f721f3e1
SHA5128a32a5a9809232697c1be323d7a0b6a9c32933fb235f75f6bcd2e4cf063f296766cf1311989eb493caff632e195d14b27f7be6103932ebead4758329a80a6c1b
-
Filesize
644KB
MD5e85f412c45f5829eca0186da9a281ea8
SHA193a5c66103ec77f45dd8f2874c4bd69a766114f3
SHA256bb6daf0c94b69206acb97902a62c359d0de201f0672da38670d30211844dd851
SHA5120cd7b3e4e858993fe045d3fd9a924cb23945c5cd6220271ecd9fcaccfd6a1a466d1bbc5d52c673d2df88100986332c6e26ddc30c575a297de649de435847ac86
-
Filesize
577KB
MD5f9c907aa7acb63955110045846fdbf2f
SHA1d34ca1f0d3bfdf6425da782fe8a148b8c992a580
SHA25619e29169ce11f06a9d11c77f7807f45ecc29a1d32e064c77cf410fba7c084733
SHA5129f66787ce39a6ce55050b6b023e1c1f69f2a701f6f9b7ad0a4aaf36e2304d80bddc524ad4caf2e23489a151ffb2a4457c85a208fd21c3beb31dd3ec71d5f2856
-
Filesize
674KB
MD54b0a74f4761ebffb03c9d08f5244c066
SHA1e81ad6df812b9eb64b3c95d96e62983d7333b106
SHA25689dd6e38ea94a4cac7c9fbf8aa9f80a8983bb84ffead2200cebf408afe1cf165
SHA512990139df84df3fde726f858431d7f2ef135911b8cde7e38b0060d07892630af6943092b61445b48335a93fb51523ba5f123c5ae09f9b9e0df46f362c5ead215a
-
Filesize
705KB
MD50f052594996a086ee277a0fd548291f7
SHA176d3a9bcccad4a177639244b96877ab7441b46b7
SHA256ac6fb77d14a9fdc83a917a93d44ef0478eb9fd1013ec06a27fcb8e47dc47434c
SHA5120c95194d6e14fd34d85cf37538aa6edc4651e1159d26e239e62d8f062a361b3146abd569a39127fc3cd7c1108f305e54c0beb75fe1f420868a1f0121b37a1796
-
Filesize
448KB
MD5dbcc5c6eba19e6c7c1be1b41c1d0cf3e
SHA1130e85001b8e24cb44d78f270bf5fe41d16b20e1
SHA2562c8692fd11e6f3434ba6fc46fe6817247df8c44bc82ed816e5033eae185b466b
SHA5123cdacc20a57f742491ef5b8771c31dc471a066ec34b046ef0305cb8d5daf2469b2886877281cffb0c14b0e134d1753cdbd72fa37d459c5536942cda911d0c998
-
Filesize
448KB
MD588e871c692b4680738050bcd1adc64b3
SHA194812eb609bcc7dd451547739eb6fa027592ea13
SHA256945216e6edbac6d9258eedf00a5f57bd527e76fc94cc66d904afef1258e053ef
SHA5126b75468869747b72a453eb6e5c3fcbcd3edbfeb99d2ce31c24b1a13f437f168806d29bdf21efdf24032d8238562730f4a8368aa4170fafe0476a0991a48206dc
-
Filesize
1.1MB
MD5d4ed4329967a4c3a2706d23ece046d48
SHA1a21ceb4353f266ed4ac2238cc211282418afa02b
SHA2567652a090af31e06cb80a412ba79abfd3570a8ac1cbbdc7d14bd7e54674508562
SHA51299d7eb9035045b2918c855a0a4c349641c503089eff49fd5763adba54d10941410b1e644c575edb74b9df35c3245d81db6a9232f7afa3418484f3745a569130b
-
Filesize
765KB
MD5e666afaf814e088b9743076a13b20452
SHA1ad23504105df11ead778273b5b5365963b3216e4
SHA256c7afaa7980e51c094d01db0ee04127b3489f91d75146f2f4a2ea11753f2e544a
SHA51243fca44e0c335a074460c9402ea36afe1d942d742fed4820ab7255976597d5248c91c786785cebbfd31d2e054fe791609ffbbfa08d11970f00ae1185e527545e
-
Filesize
1.1MB
MD543a0c8243798f6b26f945d0b9e960323
SHA1f9fbc4b78de643e1bc1d5c59060d9d6de05c225b
SHA25664f00a61440b9e657b23f791b62bd0aa0b88c08da9ef008b23174c8f7103b793
SHA51285648630382d1bcfe8592ffc3b614ab1af7f6feffd3908387c5dab3af560ec492c032e4d38ee425e9d3ae12c1c1b078c63dba197792aa15f5a07d29b59cb33f2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize834KB
MD5c76656b09bb7df6bd2ac1a6177a0027c
SHA10c296994a249e8649b19be84dce27c9ddafef3e0
SHA256a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
SHA5128390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize797KB
MD5aeb0b6e6c5d32d1ada231285ff2ae881
SHA11f04a1c059503896336406aed1dc93340e90b742
SHA2564c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
SHA512e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize163KB
MD5e88828b5a35063aa16c68ffb8322215d
SHA18225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA25699facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
SHA512e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.3MB
MD5006498313e139299a5383f0892c954b9
SHA17b3aa10930da9f29272154e2674b86876957ce3a
SHA256489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
SHA5126a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
Filesize148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\00cf0faa3d37faa0ea2d240c1ca307ef\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize143KB
MD575c84340d765d73eac1c743a31b6571a
SHA152aeef700a52b8e687316f42816eb9c0599354df
SHA256b72a1f7da8b3c3dc95c2252319f6f3e71c81ed8bd59a5b31bd2861e14c364459
SHA5129a9cdbc3a103e733150fae265c594dd7378ca402521387e466732f2431472a6a0e6cb4dfe02fe9f5b975a1739c685471ad2a4dddcdf6f12c4b5be469832fd5f1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
Filesize158KB
MD5a763a9348ab4ee3bd593bb17d854e51b
SHA14d0c97ba6877e2f9ab32fe1316936a4f2e0ff2c9
SHA256b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
SHA512e8d3896d4bd788d3ed923e0c9d3ba19fe9fc507060e2e5e8e410964f4c9d7331928324a79336079ccc84c050d8f0acfb03126a2e3622daac3846b0bfd028f602
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
Filesize296KB
MD57687295a6e19cc656b077e6a61629d4e
SHA1fa1025de5cffb56a3d1f8cae9d09b7171b33326e
SHA256ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
SHA51219de95fd90bc6f091e785074ee71dc15d450d65fbdea933e26650fb9c747d81ae2fca7f5f83192f17451a49a314d264cabea2202c805b6ffab729d381675734c
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4487aa8d9010f6a46f94684e342c735b\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize180KB
MD5ef3170a4e54cd088248f232001ee4967
SHA16e5da70ecc2224f9e2321ab3e0ebb7c6edfd8193
SHA256685e3b119d3eba48ab030539461f823c36ebf458b55bff836c6b4185db1414f1
SHA512917569b1d4a9eea98ce27a87b50ff7450b24a92058ae5c147e277efbe3331fafe4933d3223fee44ad0993c15d99f29ed07bfc75ddac1c115be533407bafbe613
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Filesize356KB
MD587111e9d98dc79165dfc98a1fb93100b
SHA14f5182e5ce810f6ba3bdb3418ad33c916b6013c8
SHA256971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
SHA512abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
Filesize157KB
MD57bdf8e0c9aa04b71a52dd964005f4363
SHA1a87e809146d3c70093a189c37f0a96b8bd0ce525
SHA2560406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
SHA5124983ebf42241723cf258407c7d2a0773f395c861741f4e98bd7ac86e1ef0a597f89263bb5a986b69ffd43836a5e49d8f03342736b4c3183ea0c58b8099af2051
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
Filesize648KB
MD57ebbba07bc6d54efd912bcd78b560b7b
SHA1a6aee1a80ddcdf201301ac29293c62d58bcc941d
SHA256637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
SHA5122139a0d520ed70b72dc76fdd0555185386c9c22de1e1fb7eaac0607b313500c44f856c76ac6e2cd72148ea0b86b10bdd2b0ab7daacfc945cb66a637b8d99cfe8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Filesize1.2MB
MD50637ad2bf6fc5ac1d29e547155bc818c
SHA1a502879466b6dd37eae5881bbb18353f97623852
SHA256868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
SHA5121d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
Filesize607KB
MD5e9ca062e4958cc25400c804029a5bf62
SHA11ed4374d0d0f568936fdebe17d9110481d6b3344
SHA256a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
SHA51243a9ea20d1e636201c0ce7098c198b893465b45f747ed2a002e8dd0bfc7739c28e166d259faf3a0087ae1fe59c74cc8e598f2b283cc7ebc345b6f3b5c388e520
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\973d10611e0f768dcf45630c845bc12f\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize83KB
MD5ab9d98eaf6d415e7ec1f2f3bc841aedb
SHA15867c4a56c0aa98c094f975d3334e13046a2f680
SHA256b5fd20d8191e99985e9a87a0955ae190941272e2da61ca0c56de3376bbdc1ba8
SHA512602ece01f0d5a959849969d7c313f1d8c5d7416b71d089e51e2e7cb9fefd3b43c3389cc2d590d8106fc4f47c4713a2a74db11823f77f3c6a15bbd4c3a37a94be
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Filesize65KB
MD5da9f9a01a99bd98104b19a95eeef256c
SHA1272071d5bbc0c234bc2f63dfcd5a90f83079bbab
SHA256b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
SHA512dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b7601d48f970a3ff91829c8c5de38811\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize187KB
MD531c689004b0ceb4d90ab99efbf606d4d
SHA1138ef16ce1110f43b90b6a5a56f7b7e951ca5331
SHA256521f864e2e9da88acc3ad58ee53239cc58efba27588dce069cb29e36cd24b150
SHA512f9f6f4288640104f1e0b2297131de4149892feb977dc147d5b5934ee77c11043fc9ae18229cadfb1987f6ba8671eb0100bd6a7409aa748b4b1fe09b64a2410a5
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
Filesize329KB
MD5eb09a7062a66a50fe2cb16c4a80561a7
SHA133b4c71ced7644be9802374a4f04c866394daaca
SHA256e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
SHA512c57a4c626c87032ca422df04ce7c3322662a9b0c6c06a46e93f08ca8f431295c9ae802cd79f53cae5de2b39a30bbeb756c966880e874ed44115cf511cc1ff920
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
Filesize141KB
MD558cacef7cbc000bb5ddeedc08a598f36
SHA1f8963d4ac1f7b72c2ee4a0a6d45b921f4f88bab7
SHA256124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
SHA5129cf04e365abcdcfcb9c1f927da83a2dfe0791cccb80cd84ed63b03264d1e253060c455ed8664f35aee0a59e8c172f859ba49c67c9eec811a53e656c076c6bf66
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
Filesize278KB
MD5d74d434aa70ce827715b5e0ac7eda5be
SHA1b53f3374be4c96af51c78fd873de1360f17c200f
SHA25654701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
SHA512631d09a0ff39ece829f5c23278c2c030e5ff758b285128edb7805682de75b5be1aedd914d2325f79ec98d0103660a39ae1f1a5782f5dad038b143f3774c098df
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
Filesize
855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
Filesize43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
Filesize
1.2MB
MD52bdb24c30e693ed94b9890b0ce11010c
SHA13803fa61757feb2557141eaefafcb45de1b80d42
SHA2560f205c370dc020a8a179b302fa5446c04369158c34c180649e8e94c0ea2afd33
SHA512e2e9d46a9caa59e1f6dc8fcb85ec0532665418bc8aee03997c2b9851fbb5b8356f9c6a15c99ecc1028c6b71b59fddc55cb81ce9949193f25309dbfb6a04d95c5
-
Filesize
691KB
MD58f8bc3abadc93ae1f6f6dda95f84061e
SHA1549e5e0df1105c6920988dd446e6e3432397ac2d
SHA256393d4fa317f5fef0efabe7eb5569bbb537395a59c4c2bbaac258c47c59f0f55e
SHA512c54a79071b18f8e8dc4502d0898b0eedc2593f050cac23b0c4fd2736506e44d1121e2d864bac8e5cee00a799080df949a08c9f6094af2da66e389a973198d48b
-
Filesize
691KB
MD5cd3aabc9469edbf5c6c3c7acc0996894
SHA111f85bbd1c75f4ba880d18c6f412df187111607e
SHA256642a7c0fdc14a736b1717c8264ed317748d3a572fe609ad2912f1ab029c5d62d
SHA51247ca9224ec613e150a6b7a0c71ed732638e31b4566da018a31d456d8f76e3675bf2ae69819f1ea4fb599dc3a7299be89d1c9806662264ce2e57ad833a65a8daf
-
Filesize
2.0MB
MD5600eebdc25ec60b6ec5dd1d4c00512b7
SHA1822a7984bb78c38053cc8eb34c4bf025396d8fb7
SHA2566c880c80ee16dbb33c888afc6139e185f4882d3057445548193e8723793b0487
SHA512b5059ad357bf4fe5092ad408d697a3f81dec481c6d6d5afadeb3660b1d3031da6b1f0bc65d47f8f5fd8ce88ec478a0e1319c1a77a9ffe6b2b99e3c0f74419bf6
-
Filesize
448KB
MD5db1a859169bbd9810152dd9fa8394229
SHA145aaa3d2cf428a001d83fd00dc9481b84597c5ae
SHA256f92362c83d487ce13938f7a29d90d563987aa033049ff4de1ce2b1b9a684e8d7
SHA5121f907272fab2ebd8fd3c019217c2d7ddcc09b29998303988d37f6c805c0f782bdd2d0c3af298d90497eff6d9c10094bc388cbe74ce49211fd98442b289cdb98f
-
Filesize
448KB
MD5640cf0ba281b7e3faca398e41f01ccb7
SHA1a2871fdd8ede661a4b5a606793bdca8c0e94f744
SHA256cb43699f7c0fae5271df79cf916c99789261406577070c30182e5d3e05972982
SHA5128e660b6ea5c6c6a10392991e6feb9b2890f660cfac5121037a91450f3cfb6a040a4991ba15ed28c444005220f96f1454630dd14698c19cbeeead535823109144
-
Filesize
581KB
MD584325371b327081506aa1897e6360587
SHA19e946fc8a87581ee9b2856a9773fee3b5b595d9f
SHA2569484a421822e8e08cd86346f065cec9105d6494265c2fb115ed873553e4c8a66
SHA5126bb68ca886b6a1ccf6f8e6975160f9d342fa3406c24165194de6d33e627ee3b193e1c811446c26abf76ae12212c4ddea6e94b0ce8821369cd127087863e65d20
-
Filesize
448KB
MD53615e3a930675e09de5089e1f6aa2430
SHA12a78b90637edc286ac37807aa13c205c89f67def
SHA25632a264a1327a2faa2cbdfba406d06aad96a11ec23e5b4047cc632f8a579df73e
SHA512c2d9b70e1241c08c0ce97edb5ed19ed6aaa5a802497ee404e747a87600f2a46d06cd6f2d57a996b4c1c764b8412368526ea55e46fcfd7f5080b558061d4981ba
-
Filesize
2.0MB
MD53d651955c0e67d76212347ed7392fa53
SHA161f362a45c8d8350189caef973bcaa2b1c710488
SHA256cdbf20cc762c406c04e116af1b0d2aad9676c5ead7c99fb3ddc2c14782c8790d
SHA512141cd3d3567b2b0d32de35c236c368d42dc2d3e505ff425b1c9fc9e011d1602e6ba61dc100168922d143b0891d20358b66842f56d5a476f7fc2d78569428ce99