Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 13:40

General

  • Target

    54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe

  • Size

    1.8MB

  • MD5

    3624f361b17c39793fa03e67f80f8e95

  • SHA1

    99dbca4835a44f46349295bc552b618bb97868a1

  • SHA256

    54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4

  • SHA512

    e829ee5477632ce5a0880699006fa094cd08022e4a973a8bbaf84487462a4cae5b35523f7fb5a83778bd0901742c770abc3c63a1715ead81f14a8ad4c4f76a1e

  • SSDEEP

    49152:5KJ0WR7AFPyyiSruXKpk3WFDL9zxnSYurU1EYVTE/zK:5KlBAFPydSS6W6X9ln8rUZVg/zK

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 56 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe
    "C:\Users\Admin\AppData\Local\Temp\54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2236
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2316
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2560
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2764
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1436
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2780
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1416
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 1ec -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1284
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 238 -NGENProcess 23c -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 25c -NGENProcess 24c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 244 -NGENProcess 264 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1644
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 250 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1ec -NGENProcess 264 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 270 -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:300
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 25c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2204
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 24c -NGENProcess 1d4 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2340
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 244 -NGENProcess 27c -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2808
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1dc -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1424
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 278 -NGENProcess 27c -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1208
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 244 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1148
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 264 -NGENProcess 23c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 23c -NGENProcess 1dc -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1204
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 270 -NGENProcess 1ec -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:492
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 294 -NGENProcess 264 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:380
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 1ec -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 278 -NGENProcess 2a0 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2248
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 244 -NGENProcess 1ec -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2a4 -NGENProcess 27c -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1864
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1728
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 22c -NGENProcess 234 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1904
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 1ac -NGENProcess 1b8 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3008
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 258 -NGENProcess 22c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1980
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:824
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 1b8 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1984
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 22c -Pipe 228 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:580
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1b8 -NGENProcess 22c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1172
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 270 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2528
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 264 -Pipe 1c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1072
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 278 -NGENProcess 22c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1296
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 22c -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:992
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 280 -NGENProcess 264 -Pipe 1b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1996
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 264 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2408
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 288 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:984
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 270 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
        PID:2108
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 290 -NGENProcess 278 -Pipe 22c -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1524
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 278 -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"
        2⤵
          PID:992
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 298 -NGENProcess 280 -Pipe 264 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2248
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 280 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
          2⤵
            PID:2300
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 270 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2592
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 298 -NGENProcess 2a8 -Pipe 280 -Comment "NGen Worker Process"
            2⤵
              PID:1448
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 25c -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:572
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2a4 -NGENProcess 2b0 -Pipe 298 -Comment "NGen Worker Process"
              2⤵
                PID:396
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 1ac -NGENProcess 288 -Pipe 24c -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2408
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 288 -NGENProcess 2ac -Pipe 25c -Comment "NGen Worker Process"
                2⤵
                  PID:756
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2b8 -NGENProcess 2b0 -Pipe 29c -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2928
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 1ac -NGENProcess 2c0 -Pipe 288 -Comment "NGen Worker Process"
                  2⤵
                    PID:1984
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 2a0 -NGENProcess 2b0 -Pipe 2a4 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2000
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2bc -NGENProcess 2c8 -Pipe 1ac -Comment "NGen Worker Process"
                    2⤵
                      PID:2768
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a8 -NGENProcess 2b0 -Pipe 290 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2640
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2b0 -NGENProcess 2c4 -Pipe 2a0 -Comment "NGen Worker Process"
                      2⤵
                        PID:2784
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2c8 -Pipe 2b4 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:580
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c8 -NGENProcess 2a8 -Pipe 2cc -Comment "NGen Worker Process"
                        2⤵
                          PID:396
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2d8 -NGENProcess 2c4 -Pipe 2bc -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2708
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c8 -NGENProcess 2d4 -Pipe 2b8 -Comment "NGen Worker Process"
                          2⤵
                            PID:1956
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2ac -NGENProcess 2dc -Pipe 2b0 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2296
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2c8 -Comment "NGen Worker Process"
                            2⤵
                            • Modifies data under HKEY_USERS
                            PID:884
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2dc -Pipe 2d0 -Comment "NGen Worker Process"
                            2⤵
                              PID:1988
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2ec -NGENProcess 2ac -Pipe 2a8 -Comment "NGen Worker Process"
                              2⤵
                                PID:1220
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2e0 -Comment "NGen Worker Process"
                                2⤵
                                  PID:1552
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1072
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2ac -Pipe 2e4 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1204
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2ac -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2040
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1956
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2c0 -NGENProcess 308 -Pipe 2ac -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:1960
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 308 -NGENProcess 2fc -Pipe 2d8 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1220
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2f0 -Pipe 2d4 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2244
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2ec -Pipe 2f8 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1700
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2c0 -NGENProcess 2fc -Pipe 314 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2108
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 304 -NGENProcess 2ec -Pipe 2f4 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1204
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 31c -NGENProcess 308 -Pipe 300 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2288
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2fc -Pipe 318 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:840
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2ec -Pipe 30c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1320
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 308 -Pipe 310 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2664
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2fc -Pipe 2c0 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2572
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2ec -Pipe 304 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1936
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 328 -NGENProcess 338 -Pipe 32c -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1300
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 31c -NGENProcess 2ec -Pipe 320 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:3032
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 334 -NGENProcess 340 -Pipe 328 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:1992
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 2f0 -NGENProcess 2ec -Pipe 324 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1944
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 344 -NGENProcess 31c -Pipe 2fc -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:3008
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 340 -Pipe 308 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2024
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2ec -Pipe 330 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:1708
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 31c -Pipe 33c -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2248
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 348 -NGENProcess 358 -Pipe 34c -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2640
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 334 -NGENProcess 31c -Pipe 2f0 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1172
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 35c -NGENProcess 350 -Pipe 338 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:308
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 358 -Pipe 344 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2964
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 358 -NGENProcess 348 -Pipe 368 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    PID:2252
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 348 -NGENProcess 334 -Pipe 364 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2244
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 334 -NGENProcess 35c -Pipe 370 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1296
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 2ec -NGENProcess 36c -Pipe 31c -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2248
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 374 -NGENProcess 358 -Pipe 350 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2640
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 35c -Pipe 360 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:824
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 380 -NGENProcess 36c -Pipe 37c -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:1148
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 354 -NGENProcess 340 -Pipe 358 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1492
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 384 -NGENProcess 2ec -Pipe 348 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:604
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 36c -Pipe 334 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2572
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 340 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1936
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 2ec -Pipe 378 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:396
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 388 -NGENProcess 398 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2284
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 380 -NGENProcess 2ec -Pipe 354 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:1644
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 394 -NGENProcess 3a0 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2120
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 35c -NGENProcess 2ec -Pipe 384 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2024
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 3a4 -NGENProcess 380 -Pipe 340 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2340
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 3a0 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1204
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 2ec -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2752
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 380 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:1444
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b0 -NGENProcess 3ac -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1732
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 394 -NGENProcess 380 -Pipe 35c -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2528
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3bc -NGENProcess 3a8 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:1980
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 3ac -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:2244
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 380 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:1176
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3a8 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:1984
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3ac -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1300
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 380 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2232
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3a8 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:1900
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3ac -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1644
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 380 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1284
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 3a8 -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1692
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d8 -NGENProcess 3e4 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1568
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3d0 -NGENProcess 3a8 -Pipe 2ec -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2060
                                                                                                                                          • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:756
                                                                                                                                          • C:\Windows\ehome\ehsched.exe
                                                                                                                                            C:\Windows\ehome\ehsched.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:292
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1240
                                                                                                                                          • C:\Windows\eHome\EhTray.exe
                                                                                                                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:952
                                                                                                                                          • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                            C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:624
                                                                                                                                          • C:\Windows\ehome\ehRec.exe
                                                                                                                                            C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1900
                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                            "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:2056
                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1524
                                                                                                                                          • C:\Windows\System32\msdtc.exe
                                                                                                                                            C:\Windows\System32\msdtc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2660
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2460
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1596
                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1772
                                                                                                                                          • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1452
                                                                                                                                          • C:\Windows\system32\locator.exe
                                                                                                                                            C:\Windows\system32\locator.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2948
                                                                                                                                          • C:\Windows\System32\snmptrap.exe
                                                                                                                                            C:\Windows\System32\snmptrap.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2092
                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:320
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2328
                                                                                                                                          • C:\Windows\system32\wbengine.exe
                                                                                                                                            "C:\Windows\system32\wbengine.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1548
                                                                                                                                          • C:\Windows\system32\dllhost.exe
                                                                                                                                            C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2820
                                                                                                                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                            "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2700
                                                                                                                                          • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1520
                                                                                                                                            • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1544
                                                                                                                                            • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                              "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2508

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                                                                                                                            Filesize

                                                                                                                                            706KB

                                                                                                                                            MD5

                                                                                                                                            d2c7eb17c3338c9016a399b0356fb9d7

                                                                                                                                            SHA1

                                                                                                                                            ba3396b8ca880ac9a25e8076aaa8e4bf993fcdf8

                                                                                                                                            SHA256

                                                                                                                                            525751ac0e634fb24a2f6606f4c2269737b2869b8f9d8c034ac6eef0392a9f09

                                                                                                                                            SHA512

                                                                                                                                            2e215d14185bb04848b5fed2d69c7478781a508cddb67408582cb01ff89d6c40df43cb1a1bf343c14825058f71b64fb4c05c813d1ead79bc2d35ad2cc10275ce

                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                            MD5

                                                                                                                                            5d4d905cbd9c5120fe256bcc0e8182c8

                                                                                                                                            SHA1

                                                                                                                                            72b1aca57d002dc1cfdbeee217a900ed17f5cf56

                                                                                                                                            SHA256

                                                                                                                                            8b9395f89eb19ad793e5ab8e6446a1822c11c0f64e74466f398052eeac8af309

                                                                                                                                            SHA512

                                                                                                                                            dc27fced4e9296ac1223d86a82cc84026616148720caf696b824e2a5b2165b799db1c18040a903e933bde1331d2479706007fa94869e944989096fb6c57cae1a

                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                                                                                                            Filesize

                                                                                                                                            781KB

                                                                                                                                            MD5

                                                                                                                                            671c170d291bd16b6ae25830908fbaf3

                                                                                                                                            SHA1

                                                                                                                                            1b8ba648fd53f7a69e2a59251ee5b270c8265722

                                                                                                                                            SHA256

                                                                                                                                            340fb926a4dfec185ed179f99f4c694e0c0ded5a5cfebad32c9825e7356f8a9d

                                                                                                                                            SHA512

                                                                                                                                            410eb5f29f9bc21de0f3fa962c722a7dfce164750effda59e980a186a51c6b429da3d9c996777e41b1049fe73f9c167e258d972b656aad39b7f2e0a8f3664ec9

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                                                                                                                                            Filesize

                                                                                                                                            5.2MB

                                                                                                                                            MD5

                                                                                                                                            1d6caf19d4fbf875dc737074f8e7e1bf

                                                                                                                                            SHA1

                                                                                                                                            c73e4454158b9134751fcbc84bf8702b9c2f65f2

                                                                                                                                            SHA256

                                                                                                                                            553da04d05e78adb195762054b8e513ef32e38a43cce7fe52ddc4ae8c8a23914

                                                                                                                                            SHA512

                                                                                                                                            f903fcd7d1fc8b31bc2fa4d6176e7b8bd2759d2b4a403595648cb67d2b8af5440571e3b727a7ce0e81a25dd1ba01b2cc84c9e71baaeb5a7cbbf4f3a9c02695e2

                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            0f5f46447ab3adb37ab3c31eb5078d79

                                                                                                                                            SHA1

                                                                                                                                            cb94d1313b23c594bebad3a2b168f4787ad6c5ba

                                                                                                                                            SHA256

                                                                                                                                            b051a72832ce77593eeeb818cf729165fb253bfe9066cec4ca5dcd8cf2e1a37b

                                                                                                                                            SHA512

                                                                                                                                            79c83a28e84ceaea3fecb44d290e538233c62b85c9dd6b8273706551736bf4948591696529c13bbd01e89ab84973245e5d44787db614b826e0d5d66faab993e4

                                                                                                                                          • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            MD5

                                                                                                                                            e7f8217c603bfef3dac6c52ce5f0e0b6

                                                                                                                                            SHA1

                                                                                                                                            0098786af56fcd5cb825f50904c8b9e557dd7d17

                                                                                                                                            SHA256

                                                                                                                                            62bad3f3509cb7790f8af73fa74a331f93f10a3243e2fa5412bc446fe48229f3

                                                                                                                                            SHA512

                                                                                                                                            a0d0df51486f79f6531d221fb947d668f3b51e660ad62318e097fc7e0a842ee011ea84eadea5ddea446504ef9d70117e3664dca2fc7cdfb5d977d73003f1f40c

                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

                                                                                                                                            Filesize

                                                                                                                                            24B

                                                                                                                                            MD5

                                                                                                                                            b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                            SHA1

                                                                                                                                            9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                            SHA256

                                                                                                                                            7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                            SHA512

                                                                                                                                            cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            648KB

                                                                                                                                            MD5

                                                                                                                                            712f29b63da20c8ed134994625eee1b6

                                                                                                                                            SHA1

                                                                                                                                            f7db318edd5d9075ea1c10ab2e12e691ec34499d

                                                                                                                                            SHA256

                                                                                                                                            52c8d586df1cbbbf0b4e383e392dbddeb4c06610141516701a6168715e9e1f57

                                                                                                                                            SHA512

                                                                                                                                            d04102cdb1eea25c788fc6b0f3f0b43ed4e75ec73e2d93c44b1169a9e13e48cf592d1e3d1e63fd9af15f161eec212fdee31468a10fe25df76f5a5cc20fbc3553

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                                                                                                            Filesize

                                                                                                                                            872KB

                                                                                                                                            MD5

                                                                                                                                            659d0beb4b93424230556a807f4f8f12

                                                                                                                                            SHA1

                                                                                                                                            59dcd31ad6963c7025593c205a189b16aa597f0b

                                                                                                                                            SHA256

                                                                                                                                            b33813d1169ed490f90f5546c51d08518264bf1d1136a0ad96e126f99d6b6dc7

                                                                                                                                            SHA512

                                                                                                                                            d8ceef1836a8e83e8d7e8dfea03b4a47254ffd2711931eb8c4da4c3f9f9bf1c9d1f2d1b3c71a7b2a066f6068525650faf0f8a23d80bd6f64a63ceeb0c5c2c6ff

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                                                                                                                            Filesize

                                                                                                                                            603KB

                                                                                                                                            MD5

                                                                                                                                            979dc379e51ef04b430ac94d4a537486

                                                                                                                                            SHA1

                                                                                                                                            81580dfe1207ff726ea1bd25f6ae609aabe07393

                                                                                                                                            SHA256

                                                                                                                                            fd4b02a2431a355bd258497cbd672ff38be0fccfb91d390975f941d1ca85366b

                                                                                                                                            SHA512

                                                                                                                                            33db48b0d59be5b8d3c82387ce287fac084e35e6af625be3594c01b90a2a86a7ad33d2d6e5f9ca6647dc4aa02cd7f319a2a8d5638aa564a8eb472c50db0bd5f9

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            678KB

                                                                                                                                            MD5

                                                                                                                                            0d48456bfbd80ce71dc5dd2795c4d534

                                                                                                                                            SHA1

                                                                                                                                            4e215f61b4971962377140a72bf1e0afef2ebf04

                                                                                                                                            SHA256

                                                                                                                                            ec73ba8cec2ba797b40618160fa943c5a1cb5763043965dcfe8d6ef6fcd027ce

                                                                                                                                            SHA512

                                                                                                                                            3feb9298ed48801cb9cd095a5e93184b08a86366c206fdcb361f1ce548e727283b166d0fd15d82c4a5c8db5d99ff78c93c1e1f342a0c4116906e0c5e82d0da0d

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            b7f1658bcf78adad35eabd544b8d9632

                                                                                                                                            SHA1

                                                                                                                                            ae57641393f7998244c7d3df552b73912b20725e

                                                                                                                                            SHA256

                                                                                                                                            fef150b3cb9c6f182b263af6ffe320b5124770eb22aebb5f7aa59229b3fbeb76

                                                                                                                                            SHA512

                                                                                                                                            77afd3fec0b0fe39b4c1ba3e4020a2deb1fcd7fea6ce871962debc5399bd0669fe6ea066c7dcf755e3f7fc47547bc9438e441530c63e3c5918f64306bfc66630

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            625KB

                                                                                                                                            MD5

                                                                                                                                            6becd1c650a13d275b1c0348981add35

                                                                                                                                            SHA1

                                                                                                                                            57b17df6ea37bf9d8012f5588829882cdfee9e7d

                                                                                                                                            SHA256

                                                                                                                                            7e9c160b747041bd4ed978f6463c2c91635cbcfcc7e4ac6ef0995f37863ab47b

                                                                                                                                            SHA512

                                                                                                                                            67817e208d671f9a0eb14df876d7bbd28c0c51d824e12037f2579bc2bba21b1e53e3557b9130dbf618884119eb6ca0eed255ab9cd1ca27bc7be2852c5a26a630

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                                                                                                            Filesize

                                                                                                                                            1003KB

                                                                                                                                            MD5

                                                                                                                                            b16acc1abf0fce20bf591028ed850e1c

                                                                                                                                            SHA1

                                                                                                                                            cd5078ee78a741dfd2dce05f547112c61f29e055

                                                                                                                                            SHA256

                                                                                                                                            af1c936bdffae5a1b7e3ffc654745c67cd62ac5304ebf234d32db1a19218f0fd

                                                                                                                                            SHA512

                                                                                                                                            60d97fa27a33e5e19c5d2286090a5e87e3c4ecf558c2c84f917e1691e4829ec31b9553493de83b2eda329d7ea4e16d5a99e41eed6fd34504b1cf13dd52d13bd7

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            656KB

                                                                                                                                            MD5

                                                                                                                                            2906b236ffb69ae0c8a7f0e9311a4221

                                                                                                                                            SHA1

                                                                                                                                            168d42e042f4874ed412b70c7c59841e34b91f12

                                                                                                                                            SHA256

                                                                                                                                            f13100fe40aed3f54b89cf1c45e1ee4b0622a2d032f761cfad4fe9f49b6d69ff

                                                                                                                                            SHA512

                                                                                                                                            c4a0cae44953aac898d7f3c00652c980bb819a217a7c9dd366ec1eaa474f01a9e50d6a60b0910ccd9e2afe89a3fb50327bcf89e5bc7bcb3d9b2ae0d65877398b

                                                                                                                                          • C:\Windows\SysWOW64\perfhost.exe

                                                                                                                                            Filesize

                                                                                                                                            587KB

                                                                                                                                            MD5

                                                                                                                                            cc4067cff539159549b831009a17dc5c

                                                                                                                                            SHA1

                                                                                                                                            8010553e4361692bd0384238db9e443c1017ec2b

                                                                                                                                            SHA256

                                                                                                                                            e1738b712cf971d1d5061bd8082840c119ede110317797eeef1394b0d2fd27ed

                                                                                                                                            SHA512

                                                                                                                                            ed64d9e90aef523e533d7f75264353ccde4605feaef65aea8f512fb655e9cd66381ddae2c4f269004e0ef8f1a977da1de4356956b2d9ab7396fefb002ad87eb1

                                                                                                                                          • C:\Windows\System32\Locator.exe

                                                                                                                                            Filesize

                                                                                                                                            577KB

                                                                                                                                            MD5

                                                                                                                                            957fbe6cae598714b5c0f6e1a9a30949

                                                                                                                                            SHA1

                                                                                                                                            f405c94d5dab59e1b0f7468f0f25826cbf1f7672

                                                                                                                                            SHA256

                                                                                                                                            c30792ae97077b590dee35692e0ae2225612bdebe4904938d2331f327eae6799

                                                                                                                                            SHA512

                                                                                                                                            bddce61d857c83ffd8937c7bee74635db8154eb5cff0d77ff97ef331c2ab20fcf5831dbb3f51ba39207583ddb9f3ecd8edba11fd859f65d4946226b979acdc4f

                                                                                                                                          • C:\Windows\System32\VSSVC.exe

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            219cdcf87ee76a0628203e6c93be4e7b

                                                                                                                                            SHA1

                                                                                                                                            b450d119a457521d3c080212f16458470f2eadbd

                                                                                                                                            SHA256

                                                                                                                                            b3baa69f675366db2fd3fcd00e8164d6b5071b11c14196675e1fc78d5aae497b

                                                                                                                                            SHA512

                                                                                                                                            c4415b96a03a67e5a52f5814ad5950311c11d10320bdc6ca513838f6bee1498075ce264f3f0e993e86164c9d1f01c0a215213f0e2363d70109f068ea97050f9f

                                                                                                                                          • C:\Windows\System32\alg.exe

                                                                                                                                            Filesize

                                                                                                                                            644KB

                                                                                                                                            MD5

                                                                                                                                            6dbc605d5084114eade6763865620d85

                                                                                                                                            SHA1

                                                                                                                                            afb8226dc999b98955e9c8e21424c9643cd2a7d8

                                                                                                                                            SHA256

                                                                                                                                            0819d58f2d90cb381ae4c84f772c43afa597fc61df211ff599bb69bca32fec3d

                                                                                                                                            SHA512

                                                                                                                                            6aa08b564208a38effad890b7c07056a191bd9247c6c0a4c4eb94f6d0a396eaff80e0c911b7ad100e510b745b37b3a45226bd9648c83f4cea7ce5f17f6ea293a

                                                                                                                                          • C:\Windows\System32\dllhost.exe

                                                                                                                                            Filesize

                                                                                                                                            577KB

                                                                                                                                            MD5

                                                                                                                                            ff0c55c8c0ee949b6205157f2ec976a6

                                                                                                                                            SHA1

                                                                                                                                            bbc1a184b4e4874bf24345d84526c82e3d83c6a4

                                                                                                                                            SHA256

                                                                                                                                            7577c95bba6713a7ce761966a87166e177bc241f079322aeed9e18f0b1dc016c

                                                                                                                                            SHA512

                                                                                                                                            28dbafd576a1fc9b612432cce5db61c1cafa1c70f21e8240303f2e5af170d414836bfae41005d2483fbc9a15c654e5198bb0c97ca6a7241aab042a15c1a0b507

                                                                                                                                          • C:\Windows\System32\msdtc.exe

                                                                                                                                            Filesize

                                                                                                                                            705KB

                                                                                                                                            MD5

                                                                                                                                            30b93aa7173a8bf2c9102ae7a222e029

                                                                                                                                            SHA1

                                                                                                                                            e55eba4d80edfea281d553d735d2d6d59a5f1ed6

                                                                                                                                            SHA256

                                                                                                                                            394d8e444cd44db37d9a7c8a24c867a0fa3a8e1ff071e2ada45092aa88d22f1e

                                                                                                                                            SHA512

                                                                                                                                            b83c367b27f0b0d5ef167a4d5651c0ed89949528f67e448b1d43dd7dd7b8e3e0b6b9d45c6e3a7a74cf1cc5284ccb6fe3b1af1f6178143011aa1da50b740bf6a9

                                                                                                                                          • C:\Windows\System32\vds.exe

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                            MD5

                                                                                                                                            4b21e72294680902ee8d383efce48c0a

                                                                                                                                            SHA1

                                                                                                                                            7147a71158d6d944e6434e2ec53d2fd45bb691a0

                                                                                                                                            SHA256

                                                                                                                                            b074bbe28a09ab6ca60b6051c842be83cbce272b319f05c0f05ce80b78cc5ca0

                                                                                                                                            SHA512

                                                                                                                                            cd1b786f1f94d0ba5b31297ba1bb59df38eb22fffb8fe72230939be03826ede055b5e02bedfe2a5d43421a050e9a2f51ad52258eb09d0f748556bd27aec57137

                                                                                                                                          • C:\Windows\Temp\CabEBC6.tmp

                                                                                                                                            Filesize

                                                                                                                                            29KB

                                                                                                                                            MD5

                                                                                                                                            d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                            SHA1

                                                                                                                                            e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                            SHA256

                                                                                                                                            a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                            SHA512

                                                                                                                                            17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                          • C:\Windows\Temp\Tar1325.tmp

                                                                                                                                            Filesize

                                                                                                                                            81KB

                                                                                                                                            MD5

                                                                                                                                            b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                            SHA1

                                                                                                                                            7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                            SHA256

                                                                                                                                            725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                            SHA512

                                                                                                                                            f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            105KB

                                                                                                                                            MD5

                                                                                                                                            d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                            SHA1

                                                                                                                                            9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                            SHA256

                                                                                                                                            dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                            SHA512

                                                                                                                                            5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            248KB

                                                                                                                                            MD5

                                                                                                                                            4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                            SHA1

                                                                                                                                            f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                            SHA256

                                                                                                                                            c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                            SHA512

                                                                                                                                            c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                            MD5

                                                                                                                                            598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                            SHA1

                                                                                                                                            5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                            SHA256

                                                                                                                                            e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                            SHA512

                                                                                                                                            774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            58KB

                                                                                                                                            MD5

                                                                                                                                            3d6987fc36386537669f2450761cdd9d

                                                                                                                                            SHA1

                                                                                                                                            7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                            SHA256

                                                                                                                                            34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                            SHA512

                                                                                                                                            1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            205KB

                                                                                                                                            MD5

                                                                                                                                            0a41e63195a60814fe770be368b4992f

                                                                                                                                            SHA1

                                                                                                                                            d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                            SHA256

                                                                                                                                            4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                            SHA512

                                                                                                                                            1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0f44d1d6b3becf403bb6145d0aeaa777\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            122KB

                                                                                                                                            MD5

                                                                                                                                            78dcf229be294a9ede599f1cab4519d7

                                                                                                                                            SHA1

                                                                                                                                            90587bd0174b76191ffa35c8df106c29d6f4a3d3

                                                                                                                                            SHA256

                                                                                                                                            8f8ebac826a00599afef15eee3a12cb9dc5a4efb8a8010a942f4e6ac7e7431da

                                                                                                                                            SHA512

                                                                                                                                            8fdb38fcad1f4944ec7a9c9c14a75d0bf0953d8f36c459d42623a37d3846def36dec4165fe4ac909644be2d4f39f7a2b3ad00638bfe3607c3c01434b56625d5f

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            43KB

                                                                                                                                            MD5

                                                                                                                                            68c51bcdc03e97a119431061273f045a

                                                                                                                                            SHA1

                                                                                                                                            6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                            SHA256

                                                                                                                                            4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                            SHA512

                                                                                                                                            d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\29778c43853d2e1ba9b814b8d3315bd7\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            305KB

                                                                                                                                            MD5

                                                                                                                                            0d51b7aa5fc463410386540a574cd938

                                                                                                                                            SHA1

                                                                                                                                            b88595b5331d272668865191f0ee4a9452edc392

                                                                                                                                            SHA256

                                                                                                                                            4733d3b5dc6aad0ae602785da1f1d62b32212684d48ede2770ece7a934429991

                                                                                                                                            SHA512

                                                                                                                                            549a8e0a04ecde707e7a22f1997be8792a07efd7a013a1cc7213450da83a460f93e321e92ccb7cf5dfa551c2833288dfba75da72b2462d288cdb3c021ec1c22f

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            198KB

                                                                                                                                            MD5

                                                                                                                                            9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                            SHA1

                                                                                                                                            ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                            SHA256

                                                                                                                                            469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                            SHA512

                                                                                                                                            58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\442ef11b0900745533a2905922560c74\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            221KB

                                                                                                                                            MD5

                                                                                                                                            c9aef79a6694e337a65b6bcbc073d8d3

                                                                                                                                            SHA1

                                                                                                                                            635bed652aa713bd4ab3d00c8d357d33333971fd

                                                                                                                                            SHA256

                                                                                                                                            ac302f7a05e00183589f60862cd049b6213bfff293317fdc9cf7fe57b2d47fa8

                                                                                                                                            SHA512

                                                                                                                                            2d7abb03c94fbb28512a975f4b61d841e8f2a041d74d59b9d8e066dbd91b41f69b55e3b73577ce4894d0380e4df1cbc096b0d3a59b5839d6ae919571a97320d6

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            70KB

                                                                                                                                            MD5

                                                                                                                                            57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                            SHA1

                                                                                                                                            da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                            SHA256

                                                                                                                                            1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                            SHA512

                                                                                                                                            1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            87KB

                                                                                                                                            MD5

                                                                                                                                            ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                            SHA1

                                                                                                                                            4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                            SHA256

                                                                                                                                            b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                            SHA512

                                                                                                                                            d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8aafc7e96cf8a209f844fc1fad01a947\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            271KB

                                                                                                                                            MD5

                                                                                                                                            47ef4ffe37297b5346d896a2880e4f6e

                                                                                                                                            SHA1

                                                                                                                                            94a4391e0a0742321a45342b60974ceeaea761e6

                                                                                                                                            SHA256

                                                                                                                                            6d9b3f1567e842a9d1375077ec48cacee2ac55534e3a3528896d0c95909d06e5

                                                                                                                                            SHA512

                                                                                                                                            79d7a741e578c188d8696bcf7dac59fd8c40ff669a7c4fbda8d74ea7ec1a54360d1f54726e2118f9f2a3b6aa71e9903eec8f9450622fe1988347dc500fd1001e

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            82KB

                                                                                                                                            MD5

                                                                                                                                            2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                            SHA1

                                                                                                                                            66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                            SHA256

                                                                                                                                            37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                            SHA512

                                                                                                                                            cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            58KB

                                                                                                                                            MD5

                                                                                                                                            a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                            SHA1

                                                                                                                                            500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                            SHA256

                                                                                                                                            1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                            SHA512

                                                                                                                                            b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            85KB

                                                                                                                                            MD5

                                                                                                                                            5180107f98e16bdca63e67e7e3169d22

                                                                                                                                            SHA1

                                                                                                                                            dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                            SHA256

                                                                                                                                            d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                            SHA512

                                                                                                                                            27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            298KB

                                                                                                                                            MD5

                                                                                                                                            5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                            SHA1

                                                                                                                                            1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                            SHA256

                                                                                                                                            5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                            SHA512

                                                                                                                                            58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            43KB

                                                                                                                                            MD5

                                                                                                                                            dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                            SHA1

                                                                                                                                            d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                            SHA256

                                                                                                                                            f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                            SHA512

                                                                                                                                            8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            124KB

                                                                                                                                            MD5

                                                                                                                                            929653b5b019b4555b25d55e6bf9987b

                                                                                                                                            SHA1

                                                                                                                                            993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                            SHA256

                                                                                                                                            2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                            SHA512

                                                                                                                                            effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            10b5a285eafccdd35390bb49861657e7

                                                                                                                                            SHA1

                                                                                                                                            62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                            SHA256

                                                                                                                                            5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                            SHA512

                                                                                                                                            19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            88KB

                                                                                                                                            MD5

                                                                                                                                            1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                            SHA1

                                                                                                                                            4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                            SHA256

                                                                                                                                            9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                            SHA512

                                                                                                                                            e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                          • C:\Windows\system32\fxssvc.exe

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            5e9b3dcf4beb6b930334f405761e688c

                                                                                                                                            SHA1

                                                                                                                                            634882cb5f79d5bfae37e75000833eef2b83adf9

                                                                                                                                            SHA256

                                                                                                                                            02eaf5cef41c539de5af1598e1278438fc7e2cef880600affea58132b9edf296

                                                                                                                                            SHA512

                                                                                                                                            5d3050d51ef7ebee4ded52cf18dd0b7a8e92d6f3a45e04fd09f146a13b71cb79ffb912b8b50712d4eec1a635f6a67098c610bc7dd10f7db1724fafdd1debac13

                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe

                                                                                                                                            Filesize

                                                                                                                                            765KB

                                                                                                                                            MD5

                                                                                                                                            75ee4b6537e38a08cc64ec808effa190

                                                                                                                                            SHA1

                                                                                                                                            6ad1f6f10eed7e689aea11e8ea030e0b4ad34651

                                                                                                                                            SHA256

                                                                                                                                            f47666e2457617c5ff3fafeec7b86fe3eb38537b0c4769f7e91f386c312c31c0

                                                                                                                                            SHA512

                                                                                                                                            b21999e045aa89f7cbf4bff96098621f78ede178faded74ba1cac5fb18235bcde4ad96f1a46c8e9117edf7e852721b2bb6d98ab15fcc89896d1adba8a6a98a79

                                                                                                                                          • \Windows\System32\ieetwcollector.exe

                                                                                                                                            Filesize

                                                                                                                                            674KB

                                                                                                                                            MD5

                                                                                                                                            f9107689064724bc54c2b9508d68635c

                                                                                                                                            SHA1

                                                                                                                                            9e8039b0564692ee0b40635762f07b3e578c8f29

                                                                                                                                            SHA256

                                                                                                                                            881640c25b9672f16a6cd104f7654f43e64af9e54c512a1f257beaa692392c91

                                                                                                                                            SHA512

                                                                                                                                            e63ebabe4d7c947f4d987baf58a357bd773c6db14cf67e320b2722eb57498f099573ade7775c635e2bc1c7a6bc517f982ad3b295214fb9a7cd396bb6d5eb1824

                                                                                                                                          • \Windows\System32\msiexec.exe

                                                                                                                                            Filesize

                                                                                                                                            691KB

                                                                                                                                            MD5

                                                                                                                                            6d7c93558a992a1cbfff1f5612c06a64

                                                                                                                                            SHA1

                                                                                                                                            11d4e07358d4b070267294885dc681d36bb32a4d

                                                                                                                                            SHA256

                                                                                                                                            d49f351d6dbe880137ecb954557e506a7cdcf2fdae433f26f732122084898751

                                                                                                                                            SHA512

                                                                                                                                            d534ef08d9b49ff0f9135504d27430faac276c38fee7b7e4769ea2bd958e4ea796887cf6374de2d3516aed17eab3867a73c8ed19442ebac70f5d95212cfe58da

                                                                                                                                          • \Windows\System32\snmptrap.exe

                                                                                                                                            Filesize

                                                                                                                                            581KB

                                                                                                                                            MD5

                                                                                                                                            f2b91c1029d41422846b2c6073c18c95

                                                                                                                                            SHA1

                                                                                                                                            6ddad3d302c04938f878829cacd24eac63b62288

                                                                                                                                            SHA256

                                                                                                                                            bbbf660e7694e54e4728e73b00f7586c837057a53c5bd7b53d8f46bcbf14a5b9

                                                                                                                                            SHA512

                                                                                                                                            26a2d771385d4cc1ebd87b510251a260e4559119c7c3f0779e4bb4f620a37ffcf6b10c59649e3a68011933891616eda1df29fed8d7cc19f36a5b8227d20ca9c5

                                                                                                                                          • \Windows\System32\wbengine.exe

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                            MD5

                                                                                                                                            379f3390f0c98cc028156f5022879d99

                                                                                                                                            SHA1

                                                                                                                                            1207647accc82fa8fda4cfef26f18865c17993ef

                                                                                                                                            SHA256

                                                                                                                                            b64db26c2f3756b06f4fe748f733c778c6c20ddf4729641e453c3406a06a14fa

                                                                                                                                            SHA512

                                                                                                                                            769a441537c889908e4cceead785c189f48bf28ba2f99f7bcb1f8c6322388509e914f77651cdd6e0467af4f7cf0207e2b12eed0243318d1c1f50bada8c2d185c

                                                                                                                                          • \Windows\ehome\ehrecvr.exe

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            c6f5cc0dd18865d3cccc4b7ae33af524

                                                                                                                                            SHA1

                                                                                                                                            f8b341a6fd2a399bfd4f89729cfd22a218122730

                                                                                                                                            SHA256

                                                                                                                                            18237e97f20218816c2e3c3c7bb8c9cd0b5dfb8a9925d0d02aa0dcfada224816

                                                                                                                                            SHA512

                                                                                                                                            2b066f6031a7cd41857188403905c0148246408d7c1a79d9bf223e7e4f516c28ef0602e6b50a597ebb58c8d8fc358582f535b1c576d71e1fed55f5bfd8c01b75

                                                                                                                                          • \Windows\ehome\ehsched.exe

                                                                                                                                            Filesize

                                                                                                                                            691KB

                                                                                                                                            MD5

                                                                                                                                            8dbd50b38a6d1ea6f09f52d75865bf90

                                                                                                                                            SHA1

                                                                                                                                            bfa13d8a7b3325563ed52859209dc0d42910c7dc

                                                                                                                                            SHA256

                                                                                                                                            e3088f2b2f1ff12f01a4617e6cb95605e7e63cfb2493ef590149a588b75d02a8

                                                                                                                                            SHA512

                                                                                                                                            6878530c7f6151253ee000b4f5a226cc41cba9b248dcb91dd1e453543818fbebbfa18e4d51b0a4846e83de6acbf9101fbfa25ba57c9a5e4b1d99dc842b9dbfcc

                                                                                                                                          • memory/292-192-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/292-317-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/300-774-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/320-359-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                          • memory/320-675-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                          • memory/380-900-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/492-882-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/624-219-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/624-337-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/756-299-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                          • memory/756-181-0x0000000000B00000-0x0000000000B60000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/756-180-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                          • memory/756-187-0x0000000000B00000-0x0000000000B60000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/1148-843-0x0000000003BE0000-0x0000000003C9A000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            744KB

                                                                                                                                          • memory/1148-856-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1204-879-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1204-861-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1208-835-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1208-831-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1240-324-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.2MB

                                                                                                                                          • memory/1240-215-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.2MB

                                                                                                                                          • memory/1284-665-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1284-620-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1416-614-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1416-623-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1424-830-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1436-121-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            668KB

                                                                                                                                          • memory/1436-122-0x0000000000BE0000-0x0000000000C40000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/1436-131-0x0000000000BE0000-0x0000000000C40000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/1436-175-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            668KB

                                                                                                                                          • memory/1452-613-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/1452-318-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/1524-265-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            808KB

                                                                                                                                          • memory/1524-240-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            808KB

                                                                                                                                          • memory/1548-374-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                          • memory/1548-717-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                          • memory/1596-285-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            724KB

                                                                                                                                          • memory/1596-511-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            724KB

                                                                                                                                          • memory/1600-932-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1624-859-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1644-712-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1644-700-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1728-491-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/1728-517-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/1772-573-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.3MB

                                                                                                                                          • memory/1772-308-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.3MB

                                                                                                                                          • memory/1800-676-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1800-698-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1864-929-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1864-935-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1904-544-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/1936-908-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2056-358-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                          • memory/2056-238-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                          • memory/2092-663-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/2092-338-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/2204-780-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2204-770-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2236-456-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.9MB

                                                                                                                                          • memory/2236-130-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.9MB

                                                                                                                                          • memory/2236-3-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.9MB

                                                                                                                                          • memory/2236-7-0x0000000001EA0000-0x0000000001F07000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2236-6-0x0000000001EA0000-0x0000000001F07000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2236-0-0x0000000001EA0000-0x0000000001F07000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2248-913-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2316-21-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2316-20-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2316-14-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2316-179-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            656KB

                                                                                                                                          • memory/2316-13-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            656KB

                                                                                                                                          • memory/2328-361-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                          • memory/2328-699-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                          • memory/2340-804-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2340-781-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2344-139-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2344-145-0x0000000000340000-0x00000000003A7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2344-140-0x0000000000340000-0x00000000003A7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2344-272-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2460-281-0x00000000002C0000-0x0000000000372000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/2460-461-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/2460-270-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/2460-484-0x00000000002C0000-0x0000000000372000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/2560-27-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            628KB

                                                                                                                                          • memory/2560-59-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2560-214-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            628KB

                                                                                                                                          • memory/2600-754-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2600-747-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2612-664-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2612-678-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2660-254-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            728KB

                                                                                                                                          • memory/2660-373-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            728KB

                                                                                                                                          • memory/2764-166-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            636KB

                                                                                                                                          • memory/2764-106-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            636KB

                                                                                                                                          • memory/2764-108-0x0000000000650000-0x00000000006B7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2764-118-0x0000000000650000-0x00000000006B7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2780-617-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2780-574-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2808-806-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2808-819-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2820-460-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/2820-746-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/2856-284-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2856-156-0x0000000000440000-0x00000000004A0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2856-155-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2856-162-0x0000000000440000-0x00000000004A0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2948-619-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/2948-325-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/3008-721-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/3008-749-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB