Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 00:16

General

  • Target

    4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe

  • Size

    701KB

  • MD5

    4f5fbb2c69b296d3ea4fb04435cbd900

  • SHA1

    f32cbf159df1bfdd20990c93a43c66e6a807b2c0

  • SHA256

    fd7f711ff05220509dc80eb9676fc84bde6db70b6421dcc572b5177fd36f4652

  • SHA512

    adc62e96f640dd91073f37dba32ed3a6d0bec3c4fd698e3d3c7f6315291a12d4e6d8650ce98fec4ed9c6116692a22eeee287ee68f9b3fb9b4937cefee33ffa89

  • SSDEEP

    12288:Zdj3F1uzouASA98z3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOo8:2FASz1N3RUDHNmdPCAaq8Nozgi/rE0TY

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 57 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1728
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2348
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2096
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2744
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 1ec -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 24c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 23c -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2084
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 25c -NGENProcess 248 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1284
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 250 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 1dc -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 248 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 23c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1304
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1e4 -NGENProcess 24c -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1816
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 24c -NGENProcess 268 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2288
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 260 -NGENProcess 278 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2260
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 260 -NGENProcess 24c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 248 -NGENProcess 278 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 28c -NGENProcess 1e4 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 23c -NGENProcess 268 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1260
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 294 -NGENProcess 26c -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 284 -NGENProcess 278 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2620
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 23c -NGENProcess 29c -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2124
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 280 -NGENProcess 278 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1472
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 280 -NGENProcess 23c -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 268 -NGENProcess 278 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2008
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3044
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 208 -NGENProcess 1e0 -Pipe 1ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2260
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 250 -NGENProcess 238 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1676
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 224 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2136
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 208 -Pipe 1b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2960
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1c0 -NGENProcess 224 -Pipe 20c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:868
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 208 -NGENProcess 224 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2416
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 268 -NGENProcess 260 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2312
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3012
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 25c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2596
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 270 -NGENProcess 208 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3060
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 224 -NGENProcess 278 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1956
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 278 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1312
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 208 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2580
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 208 -NGENProcess 224 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
        PID:780
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 28c -NGENProcess 274 -Pipe 270 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2572
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
        2⤵
          PID:2204
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 224 -Pipe 278 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2548
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 224 -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
          2⤵
            PID:3036
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 29c -NGENProcess 284 -Pipe 208 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2920
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
            2⤵
              PID:3008
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:3012
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
              2⤵
                PID:2368
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 224 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:1276
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 28c -Comment "NGen Worker Process"
                2⤵
                  PID:2192
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 250 -NGENProcess 294 -Pipe 284 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:676
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 294 -NGENProcess 2b0 -Pipe 2ac -Comment "NGen Worker Process"
                  2⤵
                    PID:1952
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2bc -NGENProcess 2b4 -Pipe 27c -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:1316
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2b4 -NGENProcess 250 -Pipe 2b8 -Comment "NGen Worker Process"
                    2⤵
                      PID:2260
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2c4 -NGENProcess 2b0 -Pipe 2a4 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:1992
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2b0 -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
                      2⤵
                        PID:2776
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2cc -NGENProcess 250 -Pipe 294 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:1680
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2b0 -Comment "NGen Worker Process"
                        2⤵
                          PID:2216
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2a8 -NGENProcess 250 -Pipe 2b4 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:1100
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 250 -NGENProcess 2d0 -Pipe 2cc -Comment "NGen Worker Process"
                          2⤵
                            PID:1384
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 2dc -NGENProcess 2d4 -Pipe 244 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:1964
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2d4 -NGENProcess 2a8 -Pipe 2d8 -Comment "NGen Worker Process"
                            2⤵
                            • Modifies data under HKEY_USERS
                            PID:1972
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e4 -NGENProcess 2d0 -Pipe 2c4 -Comment "NGen Worker Process"
                            2⤵
                              PID:3008
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 2e0 -Pipe 29c -Comment "NGen Worker Process"
                              2⤵
                                PID:1680
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2a8 -Pipe 250 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2504
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2d0 -Pipe 2c8 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2340
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2e0 -Pipe 2dc -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2292
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2e0 -NGENProcess 2ec -Pipe 2a8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2776
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2d0 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1688
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 300 -NGENProcess 2f8 -Pipe 2e8 -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:1316
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2fc -Comment "NGen Worker Process"
                                      2⤵
                                        PID:680
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 308 -NGENProcess 2d4 -Pipe 2f4 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2492
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 304 -Pipe 2e4 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:960
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2e0 -Pipe 2ec -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2716
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2d4 -Pipe 2f0 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2192
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 304 -Pipe 300 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:1744
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2e0 -Pipe 2f8 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1636
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2d4 -Pipe 308 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:780
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 304 -Pipe 30c -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:1136
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2e0 -Pipe 310 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:888
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2d4 -Pipe 314 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1100
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 304 -Pipe 318 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2616
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2e0 -Pipe 31c -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2960
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2d4 -Pipe 320 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2612
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 304 -Pipe 324 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1136
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2e0 -Pipe 328 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:564
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2d4 -Pipe 32c -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1104
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 304 -Pipe 330 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2500
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2e0 -Pipe 334 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2960
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2d4 -Pipe 338 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:956
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 304 -Pipe 33c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:2964
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2e0 -Pipe 340 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2368
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2d4 -Pipe 344 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1104
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 304 -Pipe 348 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    PID:2440
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 304 -NGENProcess 358 -Pipe 2e0 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:1548
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 368 -NGENProcess 2d4 -Pipe 350 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1744
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:1628
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2788
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 2d4 -Pipe 34c -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:916
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 364 -Pipe 360 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:1388
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 358 -Pipe 304 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1284
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 2d4 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:564
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 364 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2640
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 358 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1292
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 2d4 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2292
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 364 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2204
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 358 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:2992
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 2d4 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:1588
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 364 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:448
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 358 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:1972
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 2d4 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2220
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 364 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:3016
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 358 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2492
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 2d4 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:3000
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 364 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2236
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 358 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2716
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 2d4 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:676
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 364 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:564
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 358 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:592
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 2d4 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:2760
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 364 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2756
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 358 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:1744
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 2d4 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:268
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 364 -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1316
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 358 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2920
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3c8 -Pipe 108 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1624
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d0 -NGENProcess 3e0 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2640
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2836
                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                            "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:2888
                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1980
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1272
                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:2040
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2664
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:3004
                                                                                                                                          • C:\Windows\system32\dllhost.exe
                                                                                                                                            C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2560
                                                                                                                                          • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2452
                                                                                                                                          • C:\Windows\ehome\ehsched.exe
                                                                                                                                            C:\Windows\ehome\ehsched.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:780
                                                                                                                                          • C:\Windows\eHome\EhTray.exe
                                                                                                                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:1940
                                                                                                                                          • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                            C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2620
                                                                                                                                          • C:\Windows\System32\msdtc.exe
                                                                                                                                            C:\Windows\System32\msdtc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2124
                                                                                                                                          • C:\Windows\ehome\ehRec.exe
                                                                                                                                            C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:832
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2972
                                                                                                                                          • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:316
                                                                                                                                          • C:\Windows\system32\locator.exe
                                                                                                                                            C:\Windows\system32\locator.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2360
                                                                                                                                          • C:\Windows\System32\snmptrap.exe
                                                                                                                                            C:\Windows\System32\snmptrap.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1508
                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2268
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2624
                                                                                                                                          • C:\Windows\system32\wbengine.exe
                                                                                                                                            "C:\Windows\system32\wbengine.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2696
                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1524
                                                                                                                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                            "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2944
                                                                                                                                          • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1760
                                                                                                                                            • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:936
                                                                                                                                            • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                              "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1152

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                                                                                                                            Filesize

                                                                                                                                            706KB

                                                                                                                                            MD5

                                                                                                                                            ffa624318f9c1b025564cb5791eb2fee

                                                                                                                                            SHA1

                                                                                                                                            14a57a68ca7dbef8d1d8c3f4f2995289231f129b

                                                                                                                                            SHA256

                                                                                                                                            850a0578d2a05f7b488377bbbcbdc76313a592160f47a6f385dc75df4bd51b94

                                                                                                                                            SHA512

                                                                                                                                            556bcd891f00f6b6a7a6f0c47cb68783ff8e8e6f36e8e4cf3d36bba4f8a3de7e3d8d335794f8d28ae71cc4658beb5c19a909ee0b1318433eb8fc46c548d2784f

                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                            MD5

                                                                                                                                            e9de325dc06b646689751fd62242aa9a

                                                                                                                                            SHA1

                                                                                                                                            9cc36b9974536fd2e80da0d621dcfe0dacafefaf

                                                                                                                                            SHA256

                                                                                                                                            e5e6f77dc554b4370f33fc3f949d670f4fb56e17e4d2db3c3b6b1eb10938516c

                                                                                                                                            SHA512

                                                                                                                                            435e06600af00c121fb5d21d512659663c6a49a4f34ee5bc9d7505d09c7ee212d0c2d2f138e6357623f425db5bc0656b4510592377cac8c715d74817467859d6

                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                                                                                                            Filesize

                                                                                                                                            781KB

                                                                                                                                            MD5

                                                                                                                                            ef501ce8133cebbe220e615a48b801ca

                                                                                                                                            SHA1

                                                                                                                                            0e188c45b52bb5cc2e42efc3d17aa2e21595ab6c

                                                                                                                                            SHA256

                                                                                                                                            4fb5e8aa8f986efd8ba5ecd5b11db20d6da8312882f747ef530b0a4b13fb86ae

                                                                                                                                            SHA512

                                                                                                                                            5872ac8393150eca46efcbaa7b463dc1ca73d1643a2a595e04d7f9f6185705d5c15d72d827f20c5d39f9460ce4984c32afb29d66516793bdad7d99a3dbed0c2f

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                                                                                                                                            Filesize

                                                                                                                                            5.2MB

                                                                                                                                            MD5

                                                                                                                                            65d2e2d0b6297019f77ee359a134e005

                                                                                                                                            SHA1

                                                                                                                                            f6671d733502fd676ae5be8225e930e5fba72d1a

                                                                                                                                            SHA256

                                                                                                                                            b938fc8a8ac39167dd1919372b46b1dd8e479bc144011e035b67654087cfe739

                                                                                                                                            SHA512

                                                                                                                                            9e7f308a3a426653385565e4e376b9aef433d07a1213af602f00f80ec950d0e4b8ca9243840a747b717f8aa66399cca7aab2cbc5caa821c930bfe70bc684e1f3

                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            b1473e88208431e5443568627f901148

                                                                                                                                            SHA1

                                                                                                                                            771f1b462a4a457814fe34f2d0a562177bde2e05

                                                                                                                                            SHA256

                                                                                                                                            b6ce78d97ff437a5490311b2d304c2131c467fbcd3176ac0c373f1c45da585c0

                                                                                                                                            SHA512

                                                                                                                                            190d4dc1a7da104a73793f9a06b7dc2a3f6901f11ad342ef2415cf54c541d230261bf6be663b2b6ed25ac196245e0d91b7f8a11bf59577d6c5df019277449f05

                                                                                                                                          • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            MD5

                                                                                                                                            f5b10799a616dd521a007cffeb92b9ef

                                                                                                                                            SHA1

                                                                                                                                            c6eae24297ddb12673ed3617536b0b79e082ae85

                                                                                                                                            SHA256

                                                                                                                                            293347c594baa34bc956d54f5ee37b4b8f8e930c2e538793682883dd588d3eeb

                                                                                                                                            SHA512

                                                                                                                                            913b1e139fa7f62acf36c833f1fe8b61aba9f1604eec93a6208e67f5f7f2a6fc7d1aceb287904505e412266a0fd86746839e314405683b047e3ed0cf7ea6f3ef

                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

                                                                                                                                            Filesize

                                                                                                                                            24B

                                                                                                                                            MD5

                                                                                                                                            b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                            SHA1

                                                                                                                                            9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                            SHA256

                                                                                                                                            7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                            SHA512

                                                                                                                                            cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            648KB

                                                                                                                                            MD5

                                                                                                                                            8dc4ecb9ecfbacd95c53b96870d91aed

                                                                                                                                            SHA1

                                                                                                                                            341b59d7fbedb4067148a13d4909b43bb7c13e0e

                                                                                                                                            SHA256

                                                                                                                                            45d5cdabbde8403a74f0f29cf36658ad914424971cec3ad504f3695cb2125b92

                                                                                                                                            SHA512

                                                                                                                                            2fec2d9cf97bd7df8b79d6e16a8b91fb96d35c53c07043da39d7235911c6bf17e84c4d08c13f33139149572f9d58d502811388bd0ee38d9382336e45af303ecc

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                                                                                                            Filesize

                                                                                                                                            872KB

                                                                                                                                            MD5

                                                                                                                                            3a6abfef6a2f5e63bee4cb416d002749

                                                                                                                                            SHA1

                                                                                                                                            8a8dff4ad4ad08d86db6693518f3a9ab92a3c2cb

                                                                                                                                            SHA256

                                                                                                                                            577013476ddb010f2556740bd875f7cd290891ed496a96bb8e7a1d8857abc812

                                                                                                                                            SHA512

                                                                                                                                            fbd27a1f8ede38cd04035efe6659a444c431ea01078dc2944c5f303f6cb861e8fcf60d1edb27993a0b3f7f7f092a3eb0c3ee91c8fd726d487f0eb227b18509bd

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                                                                                                                            Filesize

                                                                                                                                            603KB

                                                                                                                                            MD5

                                                                                                                                            6cf5d2934b3721708ec572de713afaea

                                                                                                                                            SHA1

                                                                                                                                            b013d85da89b5f9d57654e3d94828391de2e330d

                                                                                                                                            SHA256

                                                                                                                                            d4558e897794594920e132a473c73310e54e2bcdec726bd3298c2e9eeddc6c69

                                                                                                                                            SHA512

                                                                                                                                            874c036453e0ca741deb9288c54d8d8aaed46c6682e5900f934186f4283ec132239c786adc2481a9797eb9b0a0f5c0a0eee5834c6569fb64ab703bbcd75a0cef

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            678KB

                                                                                                                                            MD5

                                                                                                                                            b339b556f8ff257f3f4f30ec10153067

                                                                                                                                            SHA1

                                                                                                                                            df87b5a95d2ad422716da8d21b9be02d9fd6d074

                                                                                                                                            SHA256

                                                                                                                                            ed879603c5ea2118c832dd65f5a20eff868fb84432a818eacaae30ef567b623a

                                                                                                                                            SHA512

                                                                                                                                            1a3e828c2e487f41167097a13e29091af49ef61796c9898612141e1ccd8d048710b535f4d29cb21d987f73c0907c483718a7b0661134d8f9ae61f8a6cbef5818

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            b9fa67b129d8a3fd4d5207afb4751e27

                                                                                                                                            SHA1

                                                                                                                                            bcfd22ad2c98b0247426d2df374fc68b62407ed1

                                                                                                                                            SHA256

                                                                                                                                            7240a877ddf4c03158e557f67269a7c36b321addee0460fcc5878ab8ddf331bc

                                                                                                                                            SHA512

                                                                                                                                            34489529de30c5f89b28e1eb51af66f65b25e76449488f0d03e19c8263e4c23d38df14f35a7eefcfb95f08467bb10c2b41f7364559721e4097632f04ee8fa722

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            625KB

                                                                                                                                            MD5

                                                                                                                                            b333863d830e1b534891e54b779d44e1

                                                                                                                                            SHA1

                                                                                                                                            2065a35cc86b0ecb4978bb1a7bcdc4c7cfeb8f37

                                                                                                                                            SHA256

                                                                                                                                            cc705393aece4e1c27c6f08b2365c59830107855f4baf249d9b3f75e96a05c29

                                                                                                                                            SHA512

                                                                                                                                            51f2042d5e4bb46a39f9effca12103c677e50a16bf0e2554b91f4d998f339b0a217cce01d684dac7c423e4e31a580532b27118c92c4049d6796c1cc36e606278

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                                                                                                            Filesize

                                                                                                                                            1003KB

                                                                                                                                            MD5

                                                                                                                                            4ccdd43d0d1d12f21bdc027c45c50a83

                                                                                                                                            SHA1

                                                                                                                                            767d969024d2884b494ca7bc1dfd60bc21d967a8

                                                                                                                                            SHA256

                                                                                                                                            66c71cc185551c95522adeb0d186bccb522dda795e134d188e547be48ccb202e

                                                                                                                                            SHA512

                                                                                                                                            aac9d5d89094a784612d1de096da975fe251c0506ca748adb7b62d736f1025064f91f205403217e9ce598f70cc2c4bf9e12204891904f1be70f6fa4b0bab954e

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                                                                                                            Filesize

                                                                                                                                            656KB

                                                                                                                                            MD5

                                                                                                                                            7146952559a2dd4c6193ff3c5cb7fc80

                                                                                                                                            SHA1

                                                                                                                                            94404214ec499f37ba94248a3dab80bb2ff82109

                                                                                                                                            SHA256

                                                                                                                                            5e5dd8db1c192cfb65a4cd317d15578187c84158577930864efc5aff8ab51c32

                                                                                                                                            SHA512

                                                                                                                                            2a099c0260326ea42dea229f5f2cc645513ba66e7978a8381e496649ad1e348337c0bc83a4756c7d3511a2c936f7b72b7cf8ceb50a8a9587cea0daa00af26003

                                                                                                                                          • C:\Windows\SysWOW64\perfhost.exe

                                                                                                                                            Filesize

                                                                                                                                            587KB

                                                                                                                                            MD5

                                                                                                                                            75c0b938b70f497d3ed281bc3442cfa3

                                                                                                                                            SHA1

                                                                                                                                            8cdb440dd608389ff1ade302b256b9fa4ba1d2e5

                                                                                                                                            SHA256

                                                                                                                                            eceeaed2043ff6c12935562e09a0e8a60cbca9b5118249dac0245ffa4fa3b13c

                                                                                                                                            SHA512

                                                                                                                                            d615dad8744c25f0902c88e157b1acba6934d13bc8acaf4ada203f1938d0da6b3baceef402338b4e9663db74c80853b17bd057c400517cd692b05c23c5c4ecfc

                                                                                                                                          • C:\Windows\System32\Locator.exe

                                                                                                                                            Filesize

                                                                                                                                            577KB

                                                                                                                                            MD5

                                                                                                                                            b941b4e92ae4aa9077ddfb7c1d49831d

                                                                                                                                            SHA1

                                                                                                                                            66ce017e9cb9dc200e1f6ecc4352bebf9dad2715

                                                                                                                                            SHA256

                                                                                                                                            843732acfa0c558b3581bf4aa7e09d34cafe135c7248522e00e4d5f5d75e8c9f

                                                                                                                                            SHA512

                                                                                                                                            479d3cd9d887e4e68b4411822fa3d04c25e8e36be3d554a65ee29b9cd6ea4666b29cb527fd5802f354880ef18c4bd8e3fd087b3bf51a5baa33735937ffc37666

                                                                                                                                          • C:\Windows\System32\ieetwcollector.exe

                                                                                                                                            Filesize

                                                                                                                                            674KB

                                                                                                                                            MD5

                                                                                                                                            a82c2e20c878ecf60d64540af8ca6c26

                                                                                                                                            SHA1

                                                                                                                                            7bdde53c13ab43274d0f4748232c157897860aef

                                                                                                                                            SHA256

                                                                                                                                            e7d66b087a3a0c03c275d35da0e5e0ad2dfcb391168244ec1ce536393c6957a3

                                                                                                                                            SHA512

                                                                                                                                            ad61140d99c24df8379d6462f84e46b4a9b8f9574c8b6fdece203c6cd848b835bf0b1681651b74fca6c327b647a3b157ff59a90ba77eff5adf763e37782812a4

                                                                                                                                          • C:\Windows\System32\snmptrap.exe

                                                                                                                                            Filesize

                                                                                                                                            581KB

                                                                                                                                            MD5

                                                                                                                                            6d0df463dfc32d62562ee3369e288f36

                                                                                                                                            SHA1

                                                                                                                                            0260dcadf6fc7a84fc98c794f19aa4e4e62fb03b

                                                                                                                                            SHA256

                                                                                                                                            8a11fa896fb1531344ec52370a56b96da5a570f7a6fdada923c430eabb0f0e26

                                                                                                                                            SHA512

                                                                                                                                            368031411c4c3dcf4f3935ba29457b81f3fd07a43ff7d491e3a6d058d5f7656488e04257705c1e04abea6708a98663bb3ebfd155266a28d459b4891e6b45effb

                                                                                                                                          • C:\Windows\System32\vds.exe

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                            MD5

                                                                                                                                            a19392f5e76c3587231cd4bfe9b1d56d

                                                                                                                                            SHA1

                                                                                                                                            12621d8ffc42e12c81ab9628850ec3bfd28ccdc9

                                                                                                                                            SHA256

                                                                                                                                            5022162c308ca459d7fc4494c0913dff5ca7288b8410aa7a2d0c46296093328d

                                                                                                                                            SHA512

                                                                                                                                            ff3ef31c5abd704fdf2453117be76fd7ef493eff053b22f52e5860bd8e796d081e09510339e763c8b8ddbfc70bfb27c68f2ea51088b8e9dd8256e0d341a05699

                                                                                                                                          • C:\Windows\Temp\CabF289.tmp

                                                                                                                                            Filesize

                                                                                                                                            29KB

                                                                                                                                            MD5

                                                                                                                                            d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                            SHA1

                                                                                                                                            e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                            SHA256

                                                                                                                                            a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                            SHA512

                                                                                                                                            17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                          • C:\Windows\Temp\Tar19F8.tmp

                                                                                                                                            Filesize

                                                                                                                                            81KB

                                                                                                                                            MD5

                                                                                                                                            b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                            SHA1

                                                                                                                                            7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                            SHA256

                                                                                                                                            725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                            SHA512

                                                                                                                                            f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            105KB

                                                                                                                                            MD5

                                                                                                                                            d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                            SHA1

                                                                                                                                            9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                            SHA256

                                                                                                                                            dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                            SHA512

                                                                                                                                            5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            248KB

                                                                                                                                            MD5

                                                                                                                                            4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                            SHA1

                                                                                                                                            f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                            SHA256

                                                                                                                                            c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                            SHA512

                                                                                                                                            c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                            MD5

                                                                                                                                            598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                            SHA1

                                                                                                                                            5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                            SHA256

                                                                                                                                            e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                            SHA512

                                                                                                                                            774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            58KB

                                                                                                                                            MD5

                                                                                                                                            3d6987fc36386537669f2450761cdd9d

                                                                                                                                            SHA1

                                                                                                                                            7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                            SHA256

                                                                                                                                            34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                            SHA512

                                                                                                                                            1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            205KB

                                                                                                                                            MD5

                                                                                                                                            0a41e63195a60814fe770be368b4992f

                                                                                                                                            SHA1

                                                                                                                                            d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                            SHA256

                                                                                                                                            4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                            SHA512

                                                                                                                                            1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            43KB

                                                                                                                                            MD5

                                                                                                                                            68c51bcdc03e97a119431061273f045a

                                                                                                                                            SHA1

                                                                                                                                            6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                            SHA256

                                                                                                                                            4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                            SHA512

                                                                                                                                            d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            198KB

                                                                                                                                            MD5

                                                                                                                                            9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                            SHA1

                                                                                                                                            ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                            SHA256

                                                                                                                                            469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                            SHA512

                                                                                                                                            58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            70KB

                                                                                                                                            MD5

                                                                                                                                            57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                            SHA1

                                                                                                                                            da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                            SHA256

                                                                                                                                            1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                            SHA512

                                                                                                                                            1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\7617cb5cf0b5c2e9ffe4c34fd5a560f8\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            221KB

                                                                                                                                            MD5

                                                                                                                                            458f724ed911827c02c55a1482387080

                                                                                                                                            SHA1

                                                                                                                                            d3714329ba042704ae13bed5c4e3aa3892d0eeda

                                                                                                                                            SHA256

                                                                                                                                            d11dd07bcac23dd68a6c707604329cdb07beddd1fec6a3871b556a2d52c60ca4

                                                                                                                                            SHA512

                                                                                                                                            b4ec62e8b3484947e5df0b5467c81c12daa795281cf0d1c8e8861d01416ac3474bd329f40bd1f57a8b24539591c420634f7ef17128acc207b8df68a7efc364a5

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            87KB

                                                                                                                                            MD5

                                                                                                                                            ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                            SHA1

                                                                                                                                            4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                            SHA256

                                                                                                                                            b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                            SHA512

                                                                                                                                            d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9d6012f07b15d13bce0269b033935cbd\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            271KB

                                                                                                                                            MD5

                                                                                                                                            edb0fd1575cb46d0c367cbd40cf60292

                                                                                                                                            SHA1

                                                                                                                                            45b6e18c4636524edd53edbc3747faf5547c278d

                                                                                                                                            SHA256

                                                                                                                                            5833b490826eec6ec0132a50fc0004663cb2adc1a8f3e55b11048fc2a37bf761

                                                                                                                                            SHA512

                                                                                                                                            f550f71c7612d7219fe43a431b4b2e7c1bb9409e0eba7d1ffcc1e36ccfd8cef84edcdb23aeb59f927c961af701b2ab3ac3e30a359e93d611ce92a7549eaae23d

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            82KB

                                                                                                                                            MD5

                                                                                                                                            2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                            SHA1

                                                                                                                                            66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                            SHA256

                                                                                                                                            37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                            SHA512

                                                                                                                                            cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            58KB

                                                                                                                                            MD5

                                                                                                                                            a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                            SHA1

                                                                                                                                            500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                            SHA256

                                                                                                                                            1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                            SHA512

                                                                                                                                            b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            85KB

                                                                                                                                            MD5

                                                                                                                                            5180107f98e16bdca63e67e7e3169d22

                                                                                                                                            SHA1

                                                                                                                                            dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                            SHA256

                                                                                                                                            d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                            SHA512

                                                                                                                                            27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d930e1d9d837e34a28ecac066efa7d5e\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            305KB

                                                                                                                                            MD5

                                                                                                                                            9adaae07a0024105f78bec9de948183a

                                                                                                                                            SHA1

                                                                                                                                            e21bf8df1af426160f5a919081265565edb4bcca

                                                                                                                                            SHA256

                                                                                                                                            121d510dbc4562a51f9018839c3d70f791f70f9a97e873a36b19c238ff7f258d

                                                                                                                                            SHA512

                                                                                                                                            a07ec5d250fd7febb2a1da66b407560ecb755284d7cbe6016982cd19b4e3046fda69b5a692c72ecd355d9a117501efab37fd0f3ffdd675344bfa71bac0b79a85

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            298KB

                                                                                                                                            MD5

                                                                                                                                            5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                            SHA1

                                                                                                                                            1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                            SHA256

                                                                                                                                            5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                            SHA512

                                                                                                                                            58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\edb26cfd1ae973cd1ba350e4cb62f2d2\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            122KB

                                                                                                                                            MD5

                                                                                                                                            7e1f15da6cd79b15b351f68fd40244e7

                                                                                                                                            SHA1

                                                                                                                                            2d107e27b1d35a3857ad38a788e96ed13991e80d

                                                                                                                                            SHA256

                                                                                                                                            699a913e9444d84fcba164cc8e3cdde19e95785f5aeb7998f8e73a526648cfd5

                                                                                                                                            SHA512

                                                                                                                                            2d3f56949d04b60694b7f9c433cfba8a5b990eee7d9455c2705c00476e4d8083bdd558439da20d7e7add0dd441574ff3535cfa8fa0c4af422fd911d3212b6c94

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            43KB

                                                                                                                                            MD5

                                                                                                                                            dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                            SHA1

                                                                                                                                            d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                            SHA256

                                                                                                                                            f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                            SHA512

                                                                                                                                            8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            124KB

                                                                                                                                            MD5

                                                                                                                                            929653b5b019b4555b25d55e6bf9987b

                                                                                                                                            SHA1

                                                                                                                                            993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                            SHA256

                                                                                                                                            2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                            SHA512

                                                                                                                                            effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            10b5a285eafccdd35390bb49861657e7

                                                                                                                                            SHA1

                                                                                                                                            62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                            SHA256

                                                                                                                                            5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                            SHA512

                                                                                                                                            19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

                                                                                                                                            Filesize

                                                                                                                                            88KB

                                                                                                                                            MD5

                                                                                                                                            1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                            SHA1

                                                                                                                                            4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                            SHA256

                                                                                                                                            9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                            SHA512

                                                                                                                                            e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                          • \Windows\System32\alg.exe

                                                                                                                                            Filesize

                                                                                                                                            644KB

                                                                                                                                            MD5

                                                                                                                                            695813fe02086145f5a008b42f1e8502

                                                                                                                                            SHA1

                                                                                                                                            6c76d791c9c1ae8dad924dbefef9925625cbc5c0

                                                                                                                                            SHA256

                                                                                                                                            22e667b9179fa62bdcddfc5081fc6fb592b4dd4c00896676d510dd9677d56c79

                                                                                                                                            SHA512

                                                                                                                                            c1225d56e8a561e6a740c84a52525f0b442426df5e277cdddcf39095134765fee7de743817d246af5ef8a138ac11f364d443f80ec0fb0757a4e537ef869c1afe

                                                                                                                                          • \Windows\System32\dllhost.exe

                                                                                                                                            Filesize

                                                                                                                                            577KB

                                                                                                                                            MD5

                                                                                                                                            4f3ab9698dca88ba959f9356bfffac2c

                                                                                                                                            SHA1

                                                                                                                                            aa9ce9e0eecb9eab8283635919c1f7f84783d8a4

                                                                                                                                            SHA256

                                                                                                                                            31c4e57a4dfe053f9fae49cc4be91518ba1287f42475b7825ca9e7b0eceff9db

                                                                                                                                            SHA512

                                                                                                                                            266172c3e123ef8a71abaf89490e0c03783560b0eb88ab84eb3b3d70d1ba87d5cd9ca400b35968ddb5fb77d0d22ee45e9379169f4fa61b90ac0c3842a5ab47d1

                                                                                                                                          • \Windows\System32\msdtc.exe

                                                                                                                                            Filesize

                                                                                                                                            705KB

                                                                                                                                            MD5

                                                                                                                                            c3dfe760f27c3fd221d867012ca0d036

                                                                                                                                            SHA1

                                                                                                                                            e271bf9ae209c5f1e485e87609eb7db5c4cfba12

                                                                                                                                            SHA256

                                                                                                                                            5467a34b1ccac602d472740c94161e461113e0abe86266bfb23c5ba2458506bf

                                                                                                                                            SHA512

                                                                                                                                            a7f866ca3c725f2b1806d6dca4194c211503f1155383a6e8c470cbef8ae95752352dcebf64d43ed27a016f779d51bad3bff668ccc6cbb186086c249a8d10a35c

                                                                                                                                          • \Windows\System32\msiexec.exe

                                                                                                                                            Filesize

                                                                                                                                            691KB

                                                                                                                                            MD5

                                                                                                                                            7937fb933771a99d4e55d2c5fc38f8a8

                                                                                                                                            SHA1

                                                                                                                                            d8712623733e82724d20daf7896d323d59ee732f

                                                                                                                                            SHA256

                                                                                                                                            0f7ab6edc034c7005c585daebef473035457abb115f101bd3f4251253d7cce50

                                                                                                                                            SHA512

                                                                                                                                            29e1501e978c9526866a827266095cc117e9e9a2dac91f93ba2290b646ae46c61f1c5e15f2ba16426dd60a74161f89ce42b7afa456a942162cb0b6d689556902

                                                                                                                                          • \Windows\ehome\ehrecvr.exe

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            35ebc628901d4a25a44a888ffc92e7ae

                                                                                                                                            SHA1

                                                                                                                                            866040b2422179696496558c386d09a9d45f9638

                                                                                                                                            SHA256

                                                                                                                                            dcd2123d70f2dda7e76fb73ef4eb37b295cdaa9d2f38bba227350ae5b628c1c6

                                                                                                                                            SHA512

                                                                                                                                            f4e94b8cf2d6cbe9887bf96e5142f30fcf33a3e1e4d96df6f9271a8d42b0dc4b10abd2858ce8d37660f8e576ca3f7f5a44c17e9c54ed641115ac50692fa0d4e1

                                                                                                                                          • \Windows\ehome\ehsched.exe

                                                                                                                                            Filesize

                                                                                                                                            691KB

                                                                                                                                            MD5

                                                                                                                                            d602e9493fa6f8cf78aa387992bdfdee

                                                                                                                                            SHA1

                                                                                                                                            23606d9d59d0bf0dfb2713aed06fbfb731f0ac47

                                                                                                                                            SHA256

                                                                                                                                            396ea663cb97505ac216ba6f4429a7c027a64ed6c615cd1fe56673631de81a96

                                                                                                                                            SHA512

                                                                                                                                            d5ef367ccbd043653e1efc2dc5db7e8af306d885db66cdc0925cd60d58de4150483d533b813162106c18adf4031436da6ffa7f20b5368e75bb0609b5bf5f28eb

                                                                                                                                          • memory/316-904-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/316-708-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/780-939-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/780-659-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/780-773-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/880-420-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/992-579-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1260-514-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1272-376-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            724KB

                                                                                                                                          • memory/1272-110-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            724KB

                                                                                                                                          • memory/1272-105-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/1276-365-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1284-388-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1304-442-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1472-553-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1472-560-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1508-919-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/1508-731-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            600KB

                                                                                                                                          • memory/1524-783-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            784KB

                                                                                                                                          • memory/1524-940-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            784KB

                                                                                                                                          • memory/1728-0-0x0000000000400000-0x00000000004B4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            720KB

                                                                                                                                          • memory/1728-26-0x0000000000400000-0x00000000004B4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            720KB

                                                                                                                                          • memory/1728-6-0x0000000000810000-0x0000000000877000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/1728-1-0x0000000000810000-0x0000000000877000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/1760-807-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                          • memory/1816-451-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1864-401-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1864-397-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1868-354-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1868-350-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/1980-102-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            808KB

                                                                                                                                          • memory/1980-115-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            808KB

                                                                                                                                          • memory/1980-91-0x0000000000F90000-0x0000000000FF0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/1980-97-0x0000000000F90000-0x0000000000FF0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/1992-532-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2008-578-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2008-582-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2040-396-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.3MB

                                                                                                                                          • memory/2040-125-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.3MB

                                                                                                                                          • memory/2084-384-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2092-313-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2092-305-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2096-118-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            628KB

                                                                                                                                          • memory/2096-30-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            628KB

                                                                                                                                          • memory/2096-39-0x0000000000E10000-0x0000000000E70000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2096-31-0x0000000000E10000-0x0000000000E70000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2124-795-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            728KB

                                                                                                                                          • memory/2124-556-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2124-680-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            728KB

                                                                                                                                          • memory/2124-536-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2260-950-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2260-468-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2268-932-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                          • memory/2268-752-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                          • memory/2272-510-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2288-464-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2348-13-0x0000000000450000-0x00000000004B0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2348-101-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            656KB

                                                                                                                                          • memory/2348-21-0x0000000000450000-0x00000000004B0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2348-12-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            656KB

                                                                                                                                          • memory/2360-727-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/2360-905-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/2452-754-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                          • memory/2452-640-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                          • memory/2560-622-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/2560-743-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            596KB

                                                                                                                                          • memory/2584-348-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2584-331-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2620-776-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2620-675-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2620-537-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2624-763-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                          • memory/2624-935-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                          • memory/2664-587-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            636KB

                                                                                                                                          • memory/2664-619-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            636KB

                                                                                                                                          • memory/2688-47-0x0000000000290000-0x00000000002F7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2688-42-0x0000000000290000-0x00000000002F7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2688-293-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2688-41-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2692-54-0x00000000006C0000-0x0000000000720000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2692-62-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2692-296-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/2692-63-0x00000000006C0000-0x0000000000720000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2696-936-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                          • memory/2696-775-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                          • memory/2744-336-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2744-324-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2836-78-0x0000000000320000-0x0000000000380000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2836-345-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.2MB

                                                                                                                                          • memory/2836-77-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.2MB

                                                                                                                                          • memory/2836-71-0x0000000000320000-0x0000000000380000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                          • memory/2876-487-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2888-100-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                          • memory/2888-87-0x0000000000A90000-0x0000000000AF7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2888-82-0x0000000000A90000-0x0000000000AF7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            412KB

                                                                                                                                          • memory/2888-349-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                          • memory/2944-949-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                          • memory/2944-796-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                          • memory/2960-410-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2960-424-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/2972-693-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/2972-903-0x00000000005B0000-0x0000000000662000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/2972-800-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            712KB

                                                                                                                                          • memory/3004-636-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            668KB

                                                                                                                                          • memory/3004-603-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            668KB

                                                                                                                                          • memory/3044-308-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/3044-294-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                          • memory/3052-488-0x0000000003C50000-0x0000000003D0A000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            744KB

                                                                                                                                          • memory/3052-492-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB

                                                                                                                                          • memory/3052-484-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            672KB