Overview

overview

7

Static

static

3

57223b7b81...18.exe

windows7-x64

7

57223b7b81...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 23:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    57223b7b814f2f161f42747928e587fa70f0b2b922e7f570fc9fb762c2850d18.exe

  • Size

    1.4MB

  • MD5

    670bf739ac40df5ba10e06434908867f

  • SHA1

    6d090717e783953c87512fa9944fa64099b42a5a

  • SHA256

    57223b7b814f2f161f42747928e587fa70f0b2b922e7f570fc9fb762c2850d18

  • SHA512

    d11286bf28422e7ddb5d674cc01106638aa23a24590ad6a9138679a2d26ddff674d9f90ebc47dadcf790b9335cddfdcafd8742be70903c980d2fcd57feaeb72e

  • SSDEEP

    12288:9aKnE5Tf/cXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:sKn0TX3743TvRk6NwG

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 55 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\57223b7b814f2f161f42747928e587fa70f0b2b922e7f570fc9fb762c2850d18.exe
    "C:\Users\Admin\AppData\Local\Temp\57223b7b814f2f161f42747928e587fa70f0b2b922e7f570fc9fb762c2850d18.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1688
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2108
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2712
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2536
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2368
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1188
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 260 -NGENProcess 250 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2456
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 264 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 25c -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2256
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 258 -NGENProcess 26c -Pipe 1f8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2412
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 264 -NGENProcess 270 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 254 -NGENProcess 26c -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1308
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 278 -NGENProcess 258 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 25c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 284 -NGENProcess 26c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 28c -NGENProcess 268 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 27c -NGENProcess 294 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 270 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 290 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1700
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 264 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:804
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 270 -NGENProcess 2a0 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2200
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2a4 -NGENProcess 268 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1236
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 2a4 -NGENProcess 270 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 264 -NGENProcess 268 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2ac -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2b0 -NGENProcess 270 -Pipe 2a8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2b4 -NGENProcess 268 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2004
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2060
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1828
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 1e4 -NGENProcess 200 -Pipe 208 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1512
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 25c -NGENProcess 238 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2176
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1b0 -NGENProcess 24c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2388
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 254 -NGENProcess 260 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:684
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 268 -NGENProcess 238 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2348
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 260 -NGENProcess 238 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2052
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 274 -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2860
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 26c -NGENProcess 268 -Pipe 1bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1684
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 238 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1828
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 238 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1704
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 284 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2560
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 268 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2320
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 28c -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1168
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
        PID:2164
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 27c -Pipe 238 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1684
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
        2⤵
          PID:2672
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 268 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1384
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
          2⤵
            PID:1688
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2452
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
            2⤵
              PID:2940
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1452
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
              2⤵
                PID:2332
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:856
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
                2⤵
                  PID:684
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 28c -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1216
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"
                  2⤵
                    PID:2528
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:1308
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
                    2⤵
                      PID:1072
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 29c -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2360
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
                      2⤵
                        PID:936
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2a4 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:664
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
                        2⤵
                          PID:1068
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2612
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
                          2⤵
                            PID:600
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:960
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:2256
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 1b0 -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"
                            2⤵
                              PID:332
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 200 -Comment "NGen Worker Process"
                              2⤵
                                PID:1352
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2632
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d4 -Pipe 2ec -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2696
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1660
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e8 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1592
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f4 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2172
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 1b0 -NGENProcess 2e8 -Pipe 300 -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:1764
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 30c -NGENProcess 1b0 -Pipe 10c -Comment "NGen Worker Process"
                                      2⤵
                                        PID:2820
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 1e4 -NGENProcess 2f0 -Pipe 308 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2024
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 2fc -NGENProcess 2f8 -Pipe 2e8 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2344
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 310 -NGENProcess 1b0 -Pipe 108 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1676
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:936
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2f8 -Pipe 304 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:1660
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 1b0 -Pipe 30c -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:488
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2f0 -Pipe 1e4 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2940
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2f8 -Pipe 2fc -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:1952
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 1b0 -Pipe 310 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1988
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2f0 -Pipe 314 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1708
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2f8 -Pipe 318 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1720
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 1b0 -Pipe 31c -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:3064
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2f0 -Pipe 320 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2676
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2f8 -Pipe 324 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1324
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 1b0 -Pipe 328 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2444
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2f0 -Pipe 32c -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2752
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2f8 -Pipe 330 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:1348
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 1b0 -Pipe 334 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2672
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2f0 -Pipe 338 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2324
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 348 -NGENProcess 354 -Pipe 33c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1304
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 340 -NGENProcess 2f0 -Pipe 2cc -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2448
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 358 -NGENProcess 350 -Pipe 1b0 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1216
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 354 -Pipe 1a8 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    PID:2276
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 354 -NGENProcess 340 -Pipe 2f0 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:3020
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 364 -NGENProcess 350 -Pipe 2f8 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2792
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 360 -Pipe 348 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:1044
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 340 -Pipe 358 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2632
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 350 -Pipe 34c -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2392
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 360 -Pipe 35c -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2152
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 340 -Pipe 354 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2496
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 350 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2876
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 360 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2104
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 340 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:2848
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 350 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2940
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 360 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:1348
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 340 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:1044
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 350 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2632
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 360 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2696
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 340 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2056
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 350 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1480
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 360 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:1204
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 340 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:568
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 350 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2656
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 360 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2940
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 340 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:1988
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 350 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1060
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 360 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:1380
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 340 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:1752
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 350 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:2056
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 360 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1728
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 340 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:1204
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 350 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:2752
                                                                                                                                          • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1080
                                                                                                                                          • C:\Windows\ehome\ehsched.exe
                                                                                                                                            C:\Windows\ehome\ehsched.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1088
                                                                                                                                          • C:\Windows\eHome\EhTray.exe
                                                                                                                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:1680
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2264
                                                                                                                                          • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                            C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3004
                                                                                                                                          • C:\Windows\ehome\ehRec.exe
                                                                                                                                            C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:280
                                                                                                                                          • C:\Windows\system32\dllhost.exe
                                                                                                                                            C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1560
                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2824
                                                                                                                                          • C:\Windows\System32\msdtc.exe
                                                                                                                                            C:\Windows\System32\msdtc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:2760
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2416
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1576
                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:2636
                                                                                                                                          • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2424
                                                                                                                                          • C:\Windows\system32\locator.exe
                                                                                                                                            C:\Windows\system32\locator.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2988
                                                                                                                                          • C:\Windows\System32\snmptrap.exe
                                                                                                                                            C:\Windows\System32\snmptrap.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3028
                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1252
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1804
                                                                                                                                          • C:\Windows\system32\wbengine.exe
                                                                                                                                            "C:\Windows\system32\wbengine.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:848
                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:324
                                                                                                                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                            "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1788
                                                                                                                                          • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:2088
                                                                                                                                            • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                              2⤵
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:2352
                                                                                                                                            • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                              "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:628
                                                                                                                                            • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:2160

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  c944475132ad49d094943614f90cede8

                                                                                                                                                  SHA1

                                                                                                                                                  24cdbaeb8e726d569f1d7d759db43c8abf16aed4

                                                                                                                                                  SHA256

                                                                                                                                                  10d0dfdf5bd8b41b48181b132dc2861158752bf722734f08cac576ab9cf531af

                                                                                                                                                  SHA512

                                                                                                                                                  b8555844d5b73d8afb6ac15f7c5a1aa0d896a76316aa2f227659c8ab5afae586d0eae4caa5180a95b36446ccdd412822704b1582c7c89b12134d3dfc128e1d75

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                  Filesize

                                                                                                                                                  30.1MB

                                                                                                                                                  MD5

                                                                                                                                                  72930d091f5234a4d5771906e99676e3

                                                                                                                                                  SHA1

                                                                                                                                                  f9e4fe588e3a38f7a54a1d0ba31dbe68b5111107

                                                                                                                                                  SHA256

                                                                                                                                                  f5db4ec2fd5e7a005526bf78993bcae4a960eefa07964923b3dead46d27b19c7

                                                                                                                                                  SHA512

                                                                                                                                                  d5067f591d8a605f9d67c9b7f541e3a7e6097b312576e7eb6b10e589c0439aeae2bdbe743744e8efdcb7647ec40c0c1b0b2a247803eda808984c774fef43f83c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.4MB

                                                                                                                                                  MD5

                                                                                                                                                  f5c8ddc0803bd17ed3e833151deff7db

                                                                                                                                                  SHA1

                                                                                                                                                  555b41028c8872125c33e50eb93b6a2ddd9f903c

                                                                                                                                                  SHA256

                                                                                                                                                  d3a85fb0b4581baa0a784ff356f5fc91fc4356d32519a1dee9e2d4dc7adf71cc

                                                                                                                                                  SHA512

                                                                                                                                                  7c5b2b49a4b50c14b4e12c094c40ed1536e33b74bc3722230507703e4dbd3166f8ec8e6ab1f514d98d09df9379382ade23df251d6b769013814329a16479e171

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                  Filesize

                                                                                                                                                  5.2MB

                                                                                                                                                  MD5

                                                                                                                                                  afc0f2c0c1c669a16985f039461401f4

                                                                                                                                                  SHA1

                                                                                                                                                  52742ee8f6546e37a51d2f8f30f3b36918b5f091

                                                                                                                                                  SHA256

                                                                                                                                                  adc70f0833377d01451d58764c622a4aba513e0943b48153750ffe05c7f15b95

                                                                                                                                                  SHA512

                                                                                                                                                  f48ca703704cb1dec4e6cae59e4f7020acad13eabd728a403f659debe5a96918e7578f7dccddc83faa38927293df80dc299663d76a5f18ee8b801ad7f0dd01bd

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  MD5

                                                                                                                                                  02eac5a8cd2ded6fff4a64aa2bfb1fcf

                                                                                                                                                  SHA1

                                                                                                                                                  dc3feb859e4ed53c9a949181235c8a74b4be414c

                                                                                                                                                  SHA256

                                                                                                                                                  78c7c5e6dbab368c01d7c191ed5e87bc939e048c58f360cd0bb0302f120188d1

                                                                                                                                                  SHA512

                                                                                                                                                  f438a56eb3403da673126af619a20834ddb033e1047922eac47f7f7b37e8175c2eeb9715be0f014a1fb0cf3a100050fa0bc20a7d28a092e352eebebf3dc806d3

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  MD5

                                                                                                                                                  6786a73988d25ad1f1735bcc5633dd7c

                                                                                                                                                  SHA1

                                                                                                                                                  50f4001dcff70767c0fb085852ab94325b6ec9e8

                                                                                                                                                  SHA256

                                                                                                                                                  b04d100d41fb62188fcc976cc84963b597ec4571dc98c5fa38cb70c77bcd4fb7

                                                                                                                                                  SHA512

                                                                                                                                                  817addb7da6679c50f8be9559f2919dee190d9c3698b4d7e55c2751830bd81c0cf647d710b300e5806799b5346b77b71e1c4236fa0c49864c17b7847e66b378c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                  MD5

                                                                                                                                                  e4e8bd22f7cb41cb482ed6d096f5454a

                                                                                                                                                  SHA1

                                                                                                                                                  fd9e9fbb155380f3cebd918891f934e7e2b9939f

                                                                                                                                                  SHA256

                                                                                                                                                  4e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7

                                                                                                                                                  SHA512

                                                                                                                                                  a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.000
                                                                                                                                                  Filesize

                                                                                                                                                  240B

                                                                                                                                                  MD5

                                                                                                                                                  7ca2da6f1e7bca562d7d9376700a912f

                                                                                                                                                  SHA1

                                                                                                                                                  67feaa004013eee76282e3b3fc196279f2577dcb

                                                                                                                                                  SHA256

                                                                                                                                                  04fd7654331261ff9ec331c31b238ba7770f082abfb817d7881813ec02084a4e

                                                                                                                                                  SHA512

                                                                                                                                                  4f2f67dee86af03dae15145649f5eb65cd158686381d26005b91aab89f017b692289050f0b1def00f8c2e724aedba4025db0baa6b55f76d402ded8006c48b38d

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                  Filesize

                                                                                                                                                  24B

                                                                                                                                                  MD5

                                                                                                                                                  b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                  SHA1

                                                                                                                                                  9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                  SHA256

                                                                                                                                                  7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                  SHA512

                                                                                                                                                  cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                  Filesize

                                                                                                                                                  872KB

                                                                                                                                                  MD5

                                                                                                                                                  7705b719a1b5b9bc031ac20723694377

                                                                                                                                                  SHA1

                                                                                                                                                  9e89268a79bbe655b86952eb86e27e94b5e57101

                                                                                                                                                  SHA256

                                                                                                                                                  1a58210274665f064818ac6a5a70cebd1ee50165562a359edd7cbf55153b0574

                                                                                                                                                  SHA512

                                                                                                                                                  371f9561ae3bf54eb9cd17262584a43312ff3ef430820474509d614df44298a527c2262bf1f70045dbed15c9c77962ce1a6feb99213060fc8a9dc5447a2407b8

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  fff2896ead744e11393b767e8666d385

                                                                                                                                                  SHA1

                                                                                                                                                  4ab63542f07bcc10df2244c8d254bbb3d836f45d

                                                                                                                                                  SHA256

                                                                                                                                                  6cb544396180b86bc0c0318094c6df407d8df04742228fe7b6af8f8a7c10155f

                                                                                                                                                  SHA512

                                                                                                                                                  24f413b84652d3600a8c61fc791e5685ff52b36a3e19e1d134cdde3d04a6ed0027bf6e8b7bb9fd4cc216e35e5f3af7a29cd217ca4afed538dc22c8724fbe588e

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  74ac1e531f483415d39e8af856f5da17

                                                                                                                                                  SHA1

                                                                                                                                                  0778b7cf1f52c02f0bb1cd6868a0cc4049665705

                                                                                                                                                  SHA256

                                                                                                                                                  2e930741b81c255d48207d85451007e099c90b99ad9b4054b4451204075b062c

                                                                                                                                                  SHA512

                                                                                                                                                  ad068e3371c71a7718297c0adf94387a681234b727a5b5cfdd2ea107e2f8f78dcfe40cf46585cee954dd84c717934858b0cab3db3c3c6afb438dbc89f313a110

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  9224b1c66de424280cf8389367b66f1f

                                                                                                                                                  SHA1

                                                                                                                                                  0647472df6ff5d5c1a1225728866b59d32514e67

                                                                                                                                                  SHA256

                                                                                                                                                  a7ea62d37339476a02022d01605c58b11508d4715e912fca342f3fc5c5c297e6

                                                                                                                                                  SHA512

                                                                                                                                                  8c6d377c8b345a0bad27350626e4b2e7ae6d36bab4150801ec6a95a728f71f74eaa1eb69afa970530927f601ebec4a55bc7c266b32c3080cb04fa2752159003d

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                  Filesize

                                                                                                                                                  1003KB

                                                                                                                                                  MD5

                                                                                                                                                  7f6e8ecd03f9c3c16cd46c5c99ad31d8

                                                                                                                                                  SHA1

                                                                                                                                                  d0663607ea0a3258a30812966c36027a53ef8e14

                                                                                                                                                  SHA256

                                                                                                                                                  e9c2f748cddfbd7e6af89e6dcc26140e4dfa1dca7558e4c171eb5a0728ecbd58

                                                                                                                                                  SHA512

                                                                                                                                                  1895caf96aa6a276f91ecf4d1289194bbd1a4a79375b13530fb2407fe4a75669da7320561d3bd2b40d82aa1d1a958b160053c1b99fbfba39f89d735451340fe3

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  590958676fa9c2c5e0c1f8704da784ea

                                                                                                                                                  SHA1

                                                                                                                                                  7523e3461c1fd260b7f7a7cabe419b753b472aae

                                                                                                                                                  SHA256

                                                                                                                                                  05d2d0dbdaa2dc43b470e6adf3691d915c5440281a482a0010c693688cfdb731

                                                                                                                                                  SHA512

                                                                                                                                                  553aac2d1a62ace71a82234a1b022ccf62d0058c4efa62e00eeb2ee74d64f12b1d72028dcf7b25f56a1453de70a68058696c434f5499141e0decabe6d3550f53

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  a52253e1f66765cb3e43fdf47ac56a21

                                                                                                                                                  SHA1

                                                                                                                                                  f8e80cac943a122621d17abf9feb7b300ea1beeb

                                                                                                                                                  SHA256

                                                                                                                                                  e50428384a44948ae948792f192dc6986d5dca6bbce9da45e68401e6eb704c36

                                                                                                                                                  SHA512

                                                                                                                                                  35b0b25ff4d0f05442eabb187349d5f8a8f6ea9c07927f77f21c01c68fb46e8c38168362c48abc64202ad3d8e8c88d066b433bcdec78e0755b41390855db29c4

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  MD5

                                                                                                                                                  d97ec7bc5bdc38e692b51ebdf1486fc0

                                                                                                                                                  SHA1

                                                                                                                                                  158a09de9a098ac0067c726edfbdf48106b0e60d

                                                                                                                                                  SHA256

                                                                                                                                                  436f0631c3eeeaa1bf2c1bce8b2a5515fa038fc57f4c25dd3299d9f5502a2d68

                                                                                                                                                  SHA512

                                                                                                                                                  f326739a5358bdfcd8a6bcae8918e1d9283bbd1025247cd1d03fb46bc78d499e94d5fd212c8f376968cd6cff875a8f0b0829024eaa92c4fbfb8cfa5641cedcf7

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\System32\VSSVC.exe
                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  MD5

                                                                                                                                                  a116ba113deff2018be8ccbdb3602c5b

                                                                                                                                                  SHA1

                                                                                                                                                  423fffbceddca3eb910b708c966e7323cdbb598c

                                                                                                                                                  SHA256

                                                                                                                                                  c7a28d5f7c40e8b02768426eb5e537149f34f55ee6552bd6539412278c412683

                                                                                                                                                  SHA512

                                                                                                                                                  ad5fe1dcf4d980cc49b5837cd3411f583a284d84e065736c717c4aebdc46315ea194b1634a0e884ace3e3f0f38eb26687622db3e37c560124d31e77cada8f180

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\System32\snmptrap.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  8a63c5e5a5c70d438b0ea44b03fb0d83

                                                                                                                                                  SHA1

                                                                                                                                                  60bc59cf6c97357c0cb2cb97369a7b5d1bc8ebb8

                                                                                                                                                  SHA256

                                                                                                                                                  965c718c5fd114848158c5c26d85023d91d22eafb61f0802c40035ad45b5a016

                                                                                                                                                  SHA512

                                                                                                                                                  c4f1fc1a3e1f6c4a74f6300c9e33e819bfec3038efb6d1e8296c83a794f54962b7fcc70c15b93bcad4c14b6eec97831de1fbce76743649e7ec04a17abdaa0ad8

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\System32\vds.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.7MB

                                                                                                                                                  MD5

                                                                                                                                                  77ba2a892f24fcd3dc1e1324acdab755

                                                                                                                                                  SHA1

                                                                                                                                                  7ec59c7cb7412256eac4736533a10f8e48026e54

                                                                                                                                                  SHA256

                                                                                                                                                  dbca0c8403214136b2b19c8b5bc484a8467b0c5c52eed6e5d1ccb60450d0ecc6

                                                                                                                                                  SHA512

                                                                                                                                                  76a2832f4f29eff6859ed7f14f1087f20dfb9d53ecbb61993c7d49e507de27fabfa91bbf8074f6f1a88bb80784242aa716484bbfc45e118b1955eb2f449a168d

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\System32\wbengine.exe
                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  MD5

                                                                                                                                                  03907a068e18b582fc14b3231e30f65c

                                                                                                                                                  SHA1

                                                                                                                                                  f53af00a4ce904b69c79bd6eaaacf9bcb9b969d9

                                                                                                                                                  SHA256

                                                                                                                                                  6a98f0dfb16f8f59c0f84c415d5d3db82b798af6e49e6d373af72c82564dee6f

                                                                                                                                                  SHA512

                                                                                                                                                  f4712096258e390f694a3990b361c3af7f4d6a4f5e99b8f502663b75949d5bee6840752ec74622fb4a3163c66b3f6c4fc5107b7f521a0d2ebec770a9917197e6

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  105KB

                                                                                                                                                  MD5

                                                                                                                                                  d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                  SHA1

                                                                                                                                                  9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                  SHA256

                                                                                                                                                  dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                  SHA512

                                                                                                                                                  5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  248KB

                                                                                                                                                  MD5

                                                                                                                                                  4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                  SHA1

                                                                                                                                                  f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                  SHA256

                                                                                                                                                  c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                  SHA512

                                                                                                                                                  c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  58KB

                                                                                                                                                  MD5

                                                                                                                                                  3d6987fc36386537669f2450761cdd9d

                                                                                                                                                  SHA1

                                                                                                                                                  7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                  SHA256

                                                                                                                                                  34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                  SHA512

                                                                                                                                                  1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  205KB

                                                                                                                                                  MD5

                                                                                                                                                  0a41e63195a60814fe770be368b4992f

                                                                                                                                                  SHA1

                                                                                                                                                  d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                  SHA256

                                                                                                                                                  4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                  SHA512

                                                                                                                                                  1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\19dec6151a738c7375cf2bf090508a1b\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  305KB

                                                                                                                                                  MD5

                                                                                                                                                  8991e808a2296ae028c9fa9aa9bc9780

                                                                                                                                                  SHA1

                                                                                                                                                  1d935b290bcc478eda8f28a32faa7ebe893bea78

                                                                                                                                                  SHA256

                                                                                                                                                  27f35a43a1d5e2d9e97b519821c8ed637191051b135d2996ced4f29c3a132645

                                                                                                                                                  SHA512

                                                                                                                                                  80dae9f47d3b4e5b81d38deac54f7e5b5cec07550d89b1a2252b5eb1d756b1cdf433bba831f82ff6ae05c68f47c54c8097a38603181e642b0ecc76cced80b7bb

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\25ec9c83c074c1ecb52d70df632aaf6f\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  122KB

                                                                                                                                                  MD5

                                                                                                                                                  564214aa834b3f8d6d271cf2eccbe078

                                                                                                                                                  SHA1

                                                                                                                                                  59e0d5e8acbd7a166d169ec19e4b5fcf3e3ffc2a

                                                                                                                                                  SHA256

                                                                                                                                                  a4c6f9296bcfc4e6e34952bd9aa2548d976665588ea63d1d70c2379ead7515a4

                                                                                                                                                  SHA512

                                                                                                                                                  080bdd7e200163c214b75d4df9a55e5d1c07d3a522ee96c9a418d22127706bc6df93a813b5f83d4f0737d83d04559125f6dd976675a646c70f695b47c8880f90

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  68c51bcdc03e97a119431061273f045a

                                                                                                                                                  SHA1

                                                                                                                                                  6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                  SHA256

                                                                                                                                                  4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                  SHA512

                                                                                                                                                  d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  198KB

                                                                                                                                                  MD5

                                                                                                                                                  9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                  SHA1

                                                                                                                                                  ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                  SHA256

                                                                                                                                                  469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                  SHA512

                                                                                                                                                  58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\660d4938c24cc2383f06e71ac3d16c70\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  271KB

                                                                                                                                                  MD5

                                                                                                                                                  eacb027112bdc7f633e05655f852abd0

                                                                                                                                                  SHA1

                                                                                                                                                  5dd03a7a4e1f8d382a57c1822f8b253c3d116a3d

                                                                                                                                                  SHA256

                                                                                                                                                  cb988904c29619ecbd749e33c4a1accd89bfa1d1ca832e073797a66893296d84

                                                                                                                                                  SHA512

                                                                                                                                                  7afc5476151654e85e3bb94f38b4578b0d9517862df4fcf9d3e761e9e2903cdd15b3b9f80d6758d2c45cf78a8a897c2f2c907d41fe6d1d407222dfe5af704c39

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  70KB

                                                                                                                                                  MD5

                                                                                                                                                  57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                  SHA1

                                                                                                                                                  da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                  SHA256

                                                                                                                                                  1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                  SHA512

                                                                                                                                                  1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  87KB

                                                                                                                                                  MD5

                                                                                                                                                  ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                  SHA1

                                                                                                                                                  4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                  SHA256

                                                                                                                                                  b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                  SHA512

                                                                                                                                                  d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8bd0e7d1eb293eabf03de1fc68c81cab\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  221KB

                                                                                                                                                  MD5

                                                                                                                                                  4b9a600fad7e094884db3ff91acaf6d4

                                                                                                                                                  SHA1

                                                                                                                                                  946438571d8fe9137bb9646cc87a1d9d8deb4ea5

                                                                                                                                                  SHA256

                                                                                                                                                  886a5c5df2ff07466480f72e3f89562646568b1c3641d98c11391d22191ec7c2

                                                                                                                                                  SHA512

                                                                                                                                                  fcb106da0095724840288dc62781ba30d07caa21f0fd601feef8ef1e15581f9122f7273de719a8b368f8a22433baa2f8eb8ef7d9f9a91eb0800f8774766d87e9

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  82KB

                                                                                                                                                  MD5

                                                                                                                                                  2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                  SHA1

                                                                                                                                                  66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                  SHA256

                                                                                                                                                  37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                  SHA512

                                                                                                                                                  cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  58KB

                                                                                                                                                  MD5

                                                                                                                                                  a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                  SHA1

                                                                                                                                                  500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                  SHA256

                                                                                                                                                  1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                  SHA512

                                                                                                                                                  b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  85KB

                                                                                                                                                  MD5

                                                                                                                                                  5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                  SHA1

                                                                                                                                                  dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                  SHA256

                                                                                                                                                  d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                  SHA512

                                                                                                                                                  27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  298KB

                                                                                                                                                  MD5

                                                                                                                                                  5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                  SHA1

                                                                                                                                                  1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                  SHA256

                                                                                                                                                  5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                  SHA512

                                                                                                                                                  58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                  SHA1

                                                                                                                                                  d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                  SHA256

                                                                                                                                                  f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                  SHA512

                                                                                                                                                  8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  124KB

                                                                                                                                                  MD5

                                                                                                                                                  929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                  SHA1

                                                                                                                                                  993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                  SHA256

                                                                                                                                                  2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                  SHA512

                                                                                                                                                  effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  MD5

                                                                                                                                                  10b5a285eafccdd35390bb49861657e7

                                                                                                                                                  SHA1

                                                                                                                                                  62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                  SHA256

                                                                                                                                                  5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                  SHA512

                                                                                                                                                  19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  88KB

                                                                                                                                                  MD5

                                                                                                                                                  1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                  SHA1

                                                                                                                                                  4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                  SHA256

                                                                                                                                                  9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                  SHA512

                                                                                                                                                  e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\ehome\ehsched.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  2b08e7dd6286136836563b55ed765c39

                                                                                                                                                  SHA1

                                                                                                                                                  ab1029bf53f80cf993788452e08e85176107521e

                                                                                                                                                  SHA256

                                                                                                                                                  d23bc959126f5606f3b0a0ac70716b9f93abbbb90f3ad03935495260ffa2e907

                                                                                                                                                  SHA512

                                                                                                                                                  982f2062ef561e576a926673869391d68d7a98568d610d6e5f50711d6ee0e901a3a2589fc15d43e5050a24207bc5351423bc94acddf51d75e399da7043c48c1b

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\system32\fxssvc.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  fba1dd8795dd5201ca7609121632566d

                                                                                                                                                  SHA1

                                                                                                                                                  901f030067fe353579b7acd06724a1ff845b3efb

                                                                                                                                                  SHA256

                                                                                                                                                  3934286c83be965659d260cc3e86006ecc0ccfaae323335076b235f4b1c09b8e

                                                                                                                                                  SHA512

                                                                                                                                                  e163737969790fae24db9c57546f1a98eaad4303cde95d060698b2ea0e57293ffbbecf0c17c4b8ef7e1ff6e69372805ae47d67fbe9379ecb8bb0dd67f2761be6

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  9a41deaaf798450795254e577f968a94

                                                                                                                                                  SHA1

                                                                                                                                                  4374d5c3237b5d00e796ad5ac8064c5bfeb3ca3c

                                                                                                                                                  SHA256

                                                                                                                                                  31c0a06a7929b6f6d0834e750fc476358ff117618a314da0a07b8684848e7b03

                                                                                                                                                  SHA512

                                                                                                                                                  9db622d77317931a3e258c8ee5b242ba4a56b1c77a15438986c4ef29f4dca2defcd287f9fd1def9eb68055d763e7dcb42362e23b049b426cc36d36619a834a4e

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  7c7744642598153bc23c43af8aab10a7

                                                                                                                                                  SHA1

                                                                                                                                                  f386b7ffa4f67105cf199ce81725b188ced4e9be

                                                                                                                                                  SHA256

                                                                                                                                                  14c7e64de55dd0a8db13e9cd75637166a86e67b1b04f0ec71ab91eeb239e5d15

                                                                                                                                                  SHA512

                                                                                                                                                  02bfa76899bbe1e6e7e7e259e9fa027025522916cd9a1abac4afccea9d2040548ffe1bb7188c4e0057ee471dd3ea393d593d656361542b4a4c96c9b2cdb6f665

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\Locator.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  2c1b3a1fd84ba53f938e8854cf272843

                                                                                                                                                  SHA1

                                                                                                                                                  cedfce81de0c6eb6aa5f43aaccf8a4a4e99aa2bd

                                                                                                                                                  SHA256

                                                                                                                                                  fe483b377433e7dbcdd8ec9c19429323c2c10ba234622157b3e9d3740b338339

                                                                                                                                                  SHA512

                                                                                                                                                  fef17c299bc8925bfca9ea77b93ba92e3b6c8d9166ab18b950931ac282e257ff2a41263b5935c6e07d894d6d1a76f457d830d88ca586acb31a42e55d04b77aae

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\alg.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  be553cb0b78a15bf9b682e51cdbed376

                                                                                                                                                  SHA1

                                                                                                                                                  4f9016d1808116f0c52522bc6c8acbd196d6d3b3

                                                                                                                                                  SHA256

                                                                                                                                                  00e61a53288b334f7a38081f2eeaab3ba6a7b26b201c7238ab50e60c4cf04c2b

                                                                                                                                                  SHA512

                                                                                                                                                  f0d13ff52e2c4e8d6ee5720c2ec1959686039850e899e8fc83a8d6dd74f30588feaca13c85b23ea51214627bd3b6276be8ae96434fb64fa85e53caf746a17105

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\dllhost.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  ce885fa8279fbc5749bd14b6e4d1279d

                                                                                                                                                  SHA1

                                                                                                                                                  15cfd7cc6a48c33cca06126c4a252e0683a1002e

                                                                                                                                                  SHA256

                                                                                                                                                  cbe076d8152f6609be689e33457325e461505c53f00451fbd66adbf232eab8f9

                                                                                                                                                  SHA512

                                                                                                                                                  38da4e4b85e0d1b3331bae87f3fc33bdd358f88d04ab5bd9d389c908c8fc156483bd51524054cece7caa5bf25340fb0f18d63969b460ea2eb154160bfab2d3a2

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\ieetwcollector.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  82fd5058cdefd4e559c567cabf36d232

                                                                                                                                                  SHA1

                                                                                                                                                  55c17ad7d8334e8e4abbf91db952965af4df90d7

                                                                                                                                                  SHA256

                                                                                                                                                  61c06f7cd261cfefa255239eccfc42c0a62c2c675ee85974cbfc62f817ca7e9e

                                                                                                                                                  SHA512

                                                                                                                                                  abdba4ed5d98f8c5bc78059273c3206d295da41a0ae37128c576cec7a5fdf84f27096cfcfcd614d6e78fce4066bd8dbc048b4a64c2343d4e13d8a5cc435c696f

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\msdtc.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  d8ea1204a8fe09caffccec28bb33381d

                                                                                                                                                  SHA1

                                                                                                                                                  b84bf52ece47038c613a2122aa856c898dab2f68

                                                                                                                                                  SHA256

                                                                                                                                                  62c293686f3df9487b66c6a54557b06d345bd12e2d7772b6e9d5755e28c27aef

                                                                                                                                                  SHA512

                                                                                                                                                  9abf48039b06a2b13c4047011c3222ed3afc309145df5175e9ae5b535bc330354f4ca417c8b10a3afd50509cbaf090d4bfa591fb3c809f6b9d09ac6e6126417c

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\msiexec.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.3MB

                                                                                                                                                  MD5

                                                                                                                                                  4f30b12e8d0d59ffb28df2f2c264d437

                                                                                                                                                  SHA1

                                                                                                                                                  35605dabe2764769329217463376242ed140da9c

                                                                                                                                                  SHA256

                                                                                                                                                  10a6d2a24677b384e1b6adb587ae449d242d7473c81b535ad21b072bb8df5478

                                                                                                                                                  SHA512

                                                                                                                                                  bc198f7eb6a0917b80f044d21da332347fc95e9f9428aba26695d36848b2893d83d4899164ce12d6c40eff0421fc2d3647d9283f51c75f6f4771ea811a8fc2f8

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.4MB

                                                                                                                                                  MD5

                                                                                                                                                  5a7a5c9f4ad4cfcdcdf62f0af7e980a6

                                                                                                                                                  SHA1

                                                                                                                                                  17474d331634caeeb7323b3e7acfc472c177952c

                                                                                                                                                  SHA256

                                                                                                                                                  9d42befdb7a53d3f623d754afef6e465bfcaf077a173ac1b2ac9f7a98e1b858b

                                                                                                                                                  SHA512

                                                                                                                                                  81e8ed89f31fc8c18c7643bb4d804409fc8a070359ca8db02fef04112f1aac24edd4d1a03115b9aca19e1fb0e5e2dfe4ae0e6a801495e7e5f64d1d001fa356c7

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\ehome\ehrecvr.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  8d18f4e3fda4034e93b8ff6dec04fbe1

                                                                                                                                                  SHA1

                                                                                                                                                  b3d6c42999d22241324ddfd388641a04014cdc8d

                                                                                                                                                  SHA256

                                                                                                                                                  d02321dda6969d053a862825fcbd5a3bd4fae2863ad00fff84c17f1529fa77eb

                                                                                                                                                  SHA512

                                                                                                                                                  c32d49ca9555676c2c7f438234d69eebb215146d45b6cfc45b7ac818f5f344db165ff735025b69765249a6313f2eeeed00061f40bd026cc505f38d80f192d1a6

                                                                                                                                                  Download Submit

                                                                                                                                                • memory/324-275-0x0000000100000000-0x0000000100203000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/324-628-0x0000000100000000-0x0000000100203000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/600-652-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/600-667-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/804-738-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/804-750-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/848-611-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/848-271-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1080-214-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1080-109-0x0000000000170000-0x00000000001D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1080-103-0x0000000000170000-0x00000000001D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1080-102-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1088-694-0x0000000140000000-0x00000001401F1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1088-114-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1088-234-0x0000000140000000-0x00000001401F1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1088-120-0x0000000140000000-0x00000001401F1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1188-485-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1188-520-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1212-691-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1236-773-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1252-573-0x0000000100000000-0x0000000100253000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.3MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1252-253-0x0000000100000000-0x0000000100253000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.3MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1308-655-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1308-639-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1324-727-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1356-537-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1356-642-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1356-517-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1356-629-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1560-159-0x0000000100000000-0x00000001001D4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1560-250-0x0000000100000000-0x00000001001D4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1576-296-0x000000002E000000-0x000000002E1F4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1576-203-0x000000002E000000-0x000000002E1F4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1688-146-0x00000000002B0000-0x0000000000310000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1688-147-0x0000000140000000-0x000000014020B000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1688-0-0x00000000002B0000-0x0000000000310000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1688-8-0x0000000140000000-0x000000014020B000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1688-90-0x0000000140000000-0x000000014020B000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1688-9-0x00000000002B0000-0x0000000000310000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1700-741-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1700-729-0x0000000001C00000-0x0000000001CBA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  744KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1700-728-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1788-632-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1788-299-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1804-266-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1804-591-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1812-706-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1828-426-0x0000000140000000-0x00000001401ED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1828-302-0x0000000140000000-0x00000001401ED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1876-69-0x0000000000350000-0x00000000003B7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1876-68-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1876-187-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1876-74-0x0000000000350000-0x00000000003B7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2060-301-0x0000000140000000-0x00000001401ED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2060-236-0x0000000140000000-0x00000001401ED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2088-314-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2088-651-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2108-136-0x0000000100000000-0x00000001001E3000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2108-14-0x0000000100000000-0x00000001001E3000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2200-752-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2200-755-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2256-592-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2256-616-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2264-137-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2264-237-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2368-54-0x0000000000430000-0x0000000000490000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2368-78-0x0000000010000000-0x00000000101E6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2368-47-0x0000000010000000-0x00000000101E6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2368-48-0x0000000000430000-0x0000000000490000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2412-620-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2412-612-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2416-188-0x0000000000610000-0x0000000000801000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2416-270-0x0000000100000000-0x00000001001F1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2416-274-0x0000000000610000-0x0000000000801000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2416-185-0x0000000100000000-0x00000001001F1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2424-235-0x0000000001000000-0x00000000011D5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2424-475-0x0000000001000000-0x00000000011D5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2456-572-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2456-535-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2536-31-0x0000000010000000-0x00000000101DE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2536-32-0x00000000003D0000-0x0000000000437000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2536-37-0x00000000003D0000-0x0000000000437000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2536-65-0x0000000010000000-0x00000000101DE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2636-215-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  5.3MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2636-305-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  5.3MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2684-202-0x0000000140000000-0x00000001401ED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2684-91-0x0000000000560000-0x00000000005C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2684-93-0x0000000140000000-0x00000001401ED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2684-84-0x0000000000560000-0x00000000005C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2712-18-0x0000000140000000-0x00000001401DC000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2712-141-0x0000000140000000-0x00000001401DC000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2712-27-0x00000000003D0000-0x0000000000430000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2712-19-0x00000000003D0000-0x0000000000430000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2760-264-0x0000000140000000-0x00000001401F5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2760-177-0x0000000140000000-0x00000001401F5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2824-181-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2824-173-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2832-575-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2832-680-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2832-663-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2832-595-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2988-514-0x0000000100000000-0x00000001001D4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2988-243-0x0000000100000000-0x00000001001D4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/3004-142-0x0000000140000000-0x00000001401ED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/3016-710-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/3016-704-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/3016-772-0x0000000000400000-0x00000000005E7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.9MB

                                                                                                                                                  Download

                                                                                                                                                • memory/3028-251-0x0000000100000000-0x00000001001D5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/3028-534-0x0000000100000000-0x00000001001D5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  Download