Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 05:37

General

  • Target

    cae6bf323bf7065e3499df46bb5b60c982d3bbad48591c685fcde67af86f16d8.exe

  • Size

    1.8MB

  • MD5

    d46e23f53839ba5acad67adcc3005d91

  • SHA1

    36609e8bedd3a36a1af8cb5141c4d1c3ff04bb50

  • SHA256

    cae6bf323bf7065e3499df46bb5b60c982d3bbad48591c685fcde67af86f16d8

  • SHA512

    89b174c10d8e6037cb283809a77bf1260df0924b42a295474b8ba1a22735b876436447d891f5ac8ecfa196ec6428f497699b05ff6d71998e9515a3826e3caf2d

  • SSDEEP

    49152:1x5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAz/snji6attJM:1vbjVkjjCAzJqEnW6at

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 51 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cae6bf323bf7065e3499df46bb5b60c982d3bbad48591c685fcde67af86f16d8.exe
    "C:\Users\Admin\AppData\Local\Temp\cae6bf323bf7065e3499df46bb5b60c982d3bbad48591c685fcde67af86f16d8.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2980
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2600
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:320
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:272
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:1824
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2680
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 248 -NGENProcess 1dc -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1dc -NGENProcess 250 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 1d8 -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1544
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 25c -NGENProcess 240 -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2816
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 240 -NGENProcess 248 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2492
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 260 -NGENProcess 270 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2568
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 278 -NGENProcess 1d8 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 280 -NGENProcess 248 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1804
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 248 -NGENProcess 240 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2332
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 264 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1dc -NGENProcess 270 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:548
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1dc -NGENProcess 240 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 25c -NGENProcess 270 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1160
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 294 -NGENProcess 248 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2512
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 240 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2772
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 270 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1172
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 248 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1100
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 240 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:752
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 240 -NGENProcess 298 -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2932
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 298 -NGENProcess 270 -Pipe 2b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2396
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 11c -InterruptEvent 228 -NGENProcess 224 -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 1f4 -NGENProcess 1fc -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 26c -NGENProcess 27c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2192
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 268 -NGENProcess 224 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2172
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 244 -NGENProcess 1fc -Pipe 218 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:944
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 224 -NGENProcess 1fc -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:836
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 220 -NGENProcess 254 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2452
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 254 -NGENProcess 244 -Pipe 11c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1712
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d4 -NGENProcess 1fc -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1592
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1fc -NGENProcess 220 -Pipe 1c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 25c -NGENProcess 244 -Pipe 224 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 1d4 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 264 -NGENProcess 220 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1464
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 220 -NGENProcess 25c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
        PID:1500
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 270 -NGENProcess 1d4 -Pipe 1fc -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:960
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1d4 -NGENProcess 264 -Pipe 298 -Comment "NGen Worker Process"
        2⤵
          PID:2308
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 2a8 -NGENProcess 25c -Pipe 244 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1472
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 25c -NGENProcess 270 -Pipe 2a4 -Comment "NGen Worker Process"
          2⤵
            PID:2172
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 248 -NGENProcess 264 -Pipe 220 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2936
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 264 -NGENProcess 2a8 -Pipe 2a0 -Comment "NGen Worker Process"
            2⤵
              PID:1824
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2b8 -NGENProcess 270 -Pipe 1d4 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:960
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 270 -NGENProcess 248 -Pipe 2b4 -Comment "NGen Worker Process"
              2⤵
                PID:2364
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2c0 -NGENProcess 2a8 -Pipe 25c -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2428
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a8 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
                2⤵
                  PID:1592
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2c8 -NGENProcess 248 -Pipe 264 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1148
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 248 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
                  2⤵
                    PID:1668
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 270 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2972
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2b8 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
                    2⤵
                      PID:1052
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 2a8 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2596
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
                      2⤵
                        PID:1120
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 2c8 -Pipe 248 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:1488
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
                        2⤵
                          PID:2028
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2264
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d0 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
                          2⤵
                            PID:1868
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2c0 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2160
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
                            2⤵
                            • Modifies data under HKEY_USERS
                            PID:2332
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2c8 -Comment "NGen Worker Process"
                            2⤵
                              PID:2936
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2f4 -Pipe 258 -Comment "NGen Worker Process"
                              2⤵
                                PID:1084
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2e8 -Pipe 2d0 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2444
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2e0 -Pipe 228 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:824
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2e0 -NGENProcess 2fc -Pipe 2f4 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:1500
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2fc -NGENProcess 258 -Pipe 2e8 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:3004
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 310 -NGENProcess 308 -Pipe 2f8 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2920
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 30c -Pipe 300 -Comment "NGen Worker Process"
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1616
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 258 -Pipe 304 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:2876
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 308 -Pipe 2d8 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:1540
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 2e0 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2056
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 258 -Pipe 2fc -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1464
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 308 -Pipe 310 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2524
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2900
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 258 -Pipe 318 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1868
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1744
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 30c -Pipe 320 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2212
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 258 -Pipe 324 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:568
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 308 -Pipe 328 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1600
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:884
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 258 -Pipe 330 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:940
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 308 -Pipe 334 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:1872
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2444
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 258 -Pipe 33c -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1712
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 308 -Pipe 340 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2360
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1484
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 258 -Pipe 348 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2568
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 308 -Pipe 34c -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1780
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 30c -NGENProcess 368 -Pipe 350 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:2008
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 368 -NGENProcess 29c -Pipe 36c -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:436
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 358 -NGENProcess 354 -Pipe 26c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1392
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 370 -NGENProcess 364 -Pipe 308 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2624
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 364 -NGENProcess 370 -Pipe 374 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1896
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 378 -NGENProcess 354 -Pipe 360 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2024
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 258 -Pipe 30c -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1692
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in Windows directory
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1700
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1760
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2368
                                                                                    • C:\Windows\ehome\ehRecvr.exe
                                                                                      C:\Windows\ehome\ehRecvr.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:896
                                                                                    • C:\Windows\system32\dllhost.exe
                                                                                      C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1972
                                                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1736
                                                                                    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                      "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      PID:2728
                                                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2612
                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2536
                                                                                    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:532
                                                                                    • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                                      wmiadap.exe /F /T /R
                                                                                      1⤵
                                                                                        PID:1544
                                                                                      • C:\Windows\ehome\ehsched.exe
                                                                                        C:\Windows\ehome\ehsched.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1824
                                                                                      • C:\Windows\eHome\EhTray.exe
                                                                                        "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                        1⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:2008
                                                                                      • C:\Windows\system32\IEEtwCollector.exe
                                                                                        C:\Windows\system32\IEEtwCollector.exe /V
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2680
                                                                                      • C:\Windows\System32\msdtc.exe
                                                                                        C:\Windows\System32\msdtc.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Windows directory
                                                                                        PID:2376
                                                                                      • C:\Windows\ehome\ehRec.exe
                                                                                        C:\Windows\ehome\ehRec.exe -Embedding
                                                                                        1⤵
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1708
                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1960
                                                                                      • C:\Windows\SysWow64\perfhost.exe
                                                                                        C:\Windows\SysWow64\perfhost.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2372
                                                                                      • C:\Windows\system32\locator.exe
                                                                                        C:\Windows\system32\locator.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2020
                                                                                      • C:\Windows\System32\snmptrap.exe
                                                                                        C:\Windows\System32\snmptrap.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1772
                                                                                      • C:\Windows\System32\vds.exe
                                                                                        C:\Windows\System32\vds.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1156
                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                        C:\Windows\system32\vssvc.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2784
                                                                                      • C:\Windows\system32\wbengine.exe
                                                                                        "C:\Windows\system32\wbengine.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:672
                                                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2400
                                                                                      • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                        "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2512
                                                                                      • C:\Windows\system32\SearchIndexer.exe
                                                                                        C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2772
                                                                                        • C:\Windows\system32\SearchProtocolHost.exe
                                                                                          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                          2⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2704
                                                                                        • C:\Windows\system32\SearchFilterHost.exe
                                                                                          "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                          2⤵
                                                                                          • Modifies data under HKEY_USERS
                                                                                          PID:2080
                                                                                        • C:\Windows\system32\SearchProtocolHost.exe
                                                                                          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                          2⤵
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1892

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        80b1555c7913ab21f19e109b148b29ce

                                                                                        SHA1

                                                                                        ad3b1d6fa4235432865296a74da93d76fd449c4f

                                                                                        SHA256

                                                                                        58d13ae0069f38a62d74eece7896d88e6a501a61adc5d0711c1a50637afd4765

                                                                                        SHA512

                                                                                        4152d220c9c34f146ea206370f86a5b1ff19ae24f696e143cf65523e27048e80347cb595d8effdbfa03be5f4113ec299d532b79ecc7f33abe1d38f3a716b646c

                                                                                      • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                                                                        Filesize

                                                                                        30.1MB

                                                                                        MD5

                                                                                        a3f1ed25d46ebdab376919905bd45451

                                                                                        SHA1

                                                                                        7966e24ea6ed1ed69c439f66a9ef643d27d84c01

                                                                                        SHA256

                                                                                        6efd983f3755ea0d73bfcec8f30141a3339ee8d42d2471b1b12e052baae55b75

                                                                                        SHA512

                                                                                        d8553887ef2f69add1462be6b28577ad9d2933eef358c993dac3c20113f7b0dd477ae9bff7884c2cdd230cd30b49ffe1cdc43e17042f0210e109f7044f07483a

                                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        8ea2cb19d7b2c99008633757520297ab

                                                                                        SHA1

                                                                                        cdc17119b287aa174d46bb9f30aa9969e20fe8a7

                                                                                        SHA256

                                                                                        ae1ed48fe00a1adc445baeebcfd1ca8a018502619acf57450ab13112ca43a430

                                                                                        SHA512

                                                                                        4e5d756e1bd15b063a56bc1a9340cc5bea79883df0426380de08acead4598f7e2dda42de1729a4ff6973b8acd7654a6089e203d51434bef010ea931f2aaf6b50

                                                                                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                                                                                        Filesize

                                                                                        5.2MB

                                                                                        MD5

                                                                                        0039119e6caede04b64a9159768ea8cf

                                                                                        SHA1

                                                                                        b8e3d60a01c7ae115a38adcf87146e00cd62cab6

                                                                                        SHA256

                                                                                        167430e82fe0a024c0577e39219141f2809c6a52b26b56c69bc4c8bec9372980

                                                                                        SHA512

                                                                                        c49c2bbe9b6f6022fb27f87f44aa43f51770c1c2c8f86ae4925c341bfb57579ccb45012eaf8f8bb20ebc2e011c4dee5a7f7aef16f0eeaadd90fb75e25e52ed8b

                                                                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                                                        Filesize

                                                                                        2.1MB

                                                                                        MD5

                                                                                        9dc06be513de37503b4a698adb62641c

                                                                                        SHA1

                                                                                        49ff414cae6afb7bd9c380c7fb4fe7e3971cf235

                                                                                        SHA256

                                                                                        4c508b9d552d3c13fdf533488dce6ee57dc3ee5c62951cdc72206919749d7de0

                                                                                        SHA512

                                                                                        03511796fd92860674ebb72b3a031a926cf51e492ad7a93228693091efaa6f6dce035e584342f8f7d88b9b264f1d8fb74c370147dedfb71b11876ec2a31534e9

                                                                                      • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                                                                                        Filesize

                                                                                        1024KB

                                                                                        MD5

                                                                                        b10f79a90139977b22e43f22d7fbb19d

                                                                                        SHA1

                                                                                        a5cb234428fbc646c2baa741c47bd9da05194138

                                                                                        SHA256

                                                                                        621cbf8de56655c1d3deb588b0496ae3dc201f9d1be76fe4e4b14cca541b06e3

                                                                                        SHA512

                                                                                        fc21f79adc7fa0fde3188f9d1e27494bc3f13fcb04e10173e179602476b5aaa09a854737012b903e9f2ae8750fb54ebe06a0c45e38d1780e30fc6e637d18d8c2

                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

                                                                                        Filesize

                                                                                        24B

                                                                                        MD5

                                                                                        b9bd716de6739e51c620f2086f9c31e4

                                                                                        SHA1

                                                                                        9733d94607a3cba277e567af584510edd9febf62

                                                                                        SHA256

                                                                                        7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                        SHA512

                                                                                        cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        4f8a5e5f4b8acb5c6cbac53feafb2778

                                                                                        SHA1

                                                                                        2ad250cba73abdbcde6819910f49e5fcf1403f90

                                                                                        SHA256

                                                                                        6a5accc36ab2139b38ae768801faec4339d1eae4b5556ebdb5e85da2ec47266b

                                                                                        SHA512

                                                                                        27f8a3c19bfe0aed8a522e4c36847aa9b8cfc8d9cd5276be385f6e7fb76406eb8ac853911d13cd478d2051b5077396683282a4958d16b32104fa52528cfe32a4

                                                                                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                                                        Filesize

                                                                                        872KB

                                                                                        MD5

                                                                                        c71565f8da051026b495d884070c9165

                                                                                        SHA1

                                                                                        0a7067421b33a375e81eea25a2f97c3140db9d74

                                                                                        SHA256

                                                                                        d1225473b66a48109ba31324e2097dd06297240d51f15f36ea9d10f9e1f77d97

                                                                                        SHA512

                                                                                        36041d368d58037094b43835422cf179d903a4f7218cf5c894ac46b2269411793f2cf118a88f0d3d8657387ab163bb2fbf13324cc2f4886aedf12b85f2fa6424

                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        b552b5badfac81d54b4904f86db0444c

                                                                                        SHA1

                                                                                        f49418d711121cb3ce97de743b148b54e2ce40ec

                                                                                        SHA256

                                                                                        8c123c76c157bd4bf207a9fcc3f7864bdee0ef3d865afca3a40b68f5d436b586

                                                                                        SHA512

                                                                                        7e9c54b8137711724c897f4a7745c71453f7586ff707847da603796634c3a966cf79519c745029c0879740b6903bdf9a17039c497c7d85c7f656710066eccabd

                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        80ae0d4473ac02cff343897ebcb3bc6b

                                                                                        SHA1

                                                                                        691e6a75d255fa92ff6067f50afd256e572b07a3

                                                                                        SHA256

                                                                                        0a2d035a32f7c5982c1409f76e100a2abc78badda732fbaeaea3677e34929869

                                                                                        SHA512

                                                                                        f7413b4ea60b02747dc342c441f6f48ac9e3ff9568f63703af8909acf68b816317a147cbf8cf81b24a5b5823211a28ae1e1f3be0168eafee2878d3cc41657f32

                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                                                        Filesize

                                                                                        1003KB

                                                                                        MD5

                                                                                        2dbbaf6b431d6a0a1e89807f13f12da0

                                                                                        SHA1

                                                                                        66c8c86df9cf399da7416535edb0d1fc228ed6c4

                                                                                        SHA256

                                                                                        b1b4e0d60fb85c92af8a468028e966baec48985d9ca403d6bbb9978af2141eeb

                                                                                        SHA512

                                                                                        054333b819cd4d38442041ec0762cd5c458efb633496dfe4c58b516d35383ffb2f4d5157b4d36b6f35b9a1a8744ec2d6c823942560014bdf81f04db2916c6eec

                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        dd6457ab2227f092ce62174a7282731d

                                                                                        SHA1

                                                                                        e08da6df64f350a6dcee5f3f56fcabf58d9cefcb

                                                                                        SHA256

                                                                                        5b24e66ec7a009b3351ecc76f5b2ff41b95042f588b981b2ff8f113f5938c645

                                                                                        SHA512

                                                                                        437df997b76e5741ec9e91ff1cd1e3b3b0409f8dab182b2300504f865c474551a064acdead7b405dde9e2aca4c315e1e317ee438e10047d094dad0aba6cc7be0

                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

                                                                                        Filesize

                                                                                        8KB

                                                                                        MD5

                                                                                        7585da8b23a1bcdb854fad7805b54022

                                                                                        SHA1

                                                                                        03a4e2d7d44db37540e03cdfc92233c54d503dfd

                                                                                        SHA256

                                                                                        f3ec1d0fedb1c34e67eac475ecbb429633e49bc015aa697ca0ca8ccebcfe2284

                                                                                        SHA512

                                                                                        7fa652c541bea4d3f45d9a0db125518c1db893941590b60c4e7a30fa125a1347c6263fc0bdd954ea127b5f3b9e275b72983d1df48799fb5dac979d9aab8914c7

                                                                                      • C:\Windows\SysWOW64\perfhost.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        857d56fc82c67de1d42c9344feaebfc2

                                                                                        SHA1

                                                                                        1e200f4249ac4737e1a4ae0f801b11aeb2cd54f5

                                                                                        SHA256

                                                                                        a976527b6f3db98a48c8c9fc68aa218fc0e5a9f85632c8d2817f117d575c89dd

                                                                                        SHA512

                                                                                        456c74dce1f5ebf0cc730fc4987bc2c6513f3e1f70d976776cd48d1eaa35e26bf7008a5ca2053dab4db15aed7e9a2032cb93614f69c5a9ea49896585ce48ae8f

                                                                                      • C:\Windows\System32\Locator.exe

                                                                                        Filesize

                                                                                        1.4MB

                                                                                        MD5

                                                                                        1ce38c3a9d70de404bee430acf6722c2

                                                                                        SHA1

                                                                                        3d1b5f0f3e1143ad1b69526b7fa5ffea6426ed35

                                                                                        SHA256

                                                                                        e94663958bfe759f047b86618eca9e34acbb7c57c5e7bc3a4b6316fe4f48241d

                                                                                        SHA512

                                                                                        6921661af026f56ba6bc4844dc60342280870deae99bd2da9353929999768ff0c2ab9a84361dc9fec3b5f27a1636f7f52f90f163f7c7f76b9e7cc9a8610129ea

                                                                                      • C:\Windows\System32\msdtc.exe

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        3634db6069b76aacfffe94897c7c26a6

                                                                                        SHA1

                                                                                        fd9429c12823bea04d050f1909132a0a972827b7

                                                                                        SHA256

                                                                                        4785fd618dd20fd7eef7a5c69ea02257a4d2363917aad3ebd420ba21873bb648

                                                                                        SHA512

                                                                                        0d7f267a14efd3660c61a9e0e05fce3669d9c69872efde41366468b731ff14e729b21c7da2c7fd3bf49c261da28b7b43f5bb8a0409d776b0eabb27cbeb548e9a

                                                                                      • C:\Windows\System32\msiexec.exe

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        5440f0e1ff3dd656bf01ed4bf4b80b9a

                                                                                        SHA1

                                                                                        837c02a56ebe557b1850abbdfebcff4886dcb6dd

                                                                                        SHA256

                                                                                        aa6a778ace6737a28be5b05f0de26e3c7c60a12c3fac612bb8e8856e28ecf50c

                                                                                        SHA512

                                                                                        07f3f074189364f817db420ede87d5a6a1150eca9a5c28c6cfb34d81578fa0beda9e7cdd6c94cd9b3803d281e6233bacd917974c10a14c4a851b178fdf26d2db

                                                                                      • C:\Windows\System32\snmptrap.exe

                                                                                        Filesize

                                                                                        1.4MB

                                                                                        MD5

                                                                                        6f837455bff52846536e560e4322d368

                                                                                        SHA1

                                                                                        eade2a21087909b4c50b4f98b0c1c7ec339bbd1a

                                                                                        SHA256

                                                                                        aea9ed24432684826c5af14f83cf87d298c40d21abae5d1b257cbd7aee141a59

                                                                                        SHA512

                                                                                        3ab1bdd0a1fee15ac8c1082859ddf63b914b4f7886838b463e8d58ad19a5554583c7af11e0529a9a35d53b238680b8ec40205f2e8eb97ad3906a7d6ee3e4b0d1

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

                                                                                        Filesize

                                                                                        148KB

                                                                                        MD5

                                                                                        ac901cf97363425059a50d1398e3454b

                                                                                        SHA1

                                                                                        2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

                                                                                        SHA256

                                                                                        f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

                                                                                        SHA512

                                                                                        6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                                                        Filesize

                                                                                        34KB

                                                                                        MD5

                                                                                        c26b034a8d6ab845b41ed6e8a8d6001d

                                                                                        SHA1

                                                                                        3a55774cf22d3244d30f9eb5e26c0a6792a3e493

                                                                                        SHA256

                                                                                        620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

                                                                                        SHA512

                                                                                        483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

                                                                                        Filesize

                                                                                        109KB

                                                                                        MD5

                                                                                        0fd0f978e977a4122b64ae8f8541de54

                                                                                        SHA1

                                                                                        153d3390416fdeba1b150816cbbf968e355dc64f

                                                                                        SHA256

                                                                                        211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60

                                                                                        SHA512

                                                                                        ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

                                                                                        Filesize

                                                                                        41KB

                                                                                        MD5

                                                                                        3c269caf88ccaf71660d8dc6c56f4873

                                                                                        SHA1

                                                                                        f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

                                                                                        SHA256

                                                                                        de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

                                                                                        SHA512

                                                                                        bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4cffbd6c354740026d7a3a29dd63e3bc\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                                                        Filesize

                                                                                        143KB

                                                                                        MD5

                                                                                        1fa4c663eb7f4f3f5e7547c8d2849c90

                                                                                        SHA1

                                                                                        7a2e4dc0eacfaab69d5ddfcbf9fcec8ff55b035f

                                                                                        SHA256

                                                                                        3febbc6242bafabbb51659ed696758cc75dadcb7ffc8217b8a032590d97d9166

                                                                                        SHA512

                                                                                        3a40a81785cf707abfb6b5f88b98e6cf413391b4098d1199a1cb7f030fa2e45c3c8502ae6baa7ff56f1476ee700d5f126c14a99433802a1dd328cd66bd9dfdd9

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

                                                                                        Filesize

                                                                                        210KB

                                                                                        MD5

                                                                                        4f40997b51420653706cb0958086cd2d

                                                                                        SHA1

                                                                                        0069b956d17ce7d782a0e054995317f2f621b502

                                                                                        SHA256

                                                                                        8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

                                                                                        SHA512

                                                                                        e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

                                                                                        Filesize

                                                                                        53KB

                                                                                        MD5

                                                                                        e3a7a2b65afd8ab8b154fdc7897595c3

                                                                                        SHA1

                                                                                        b21eefd6e23231470b5cf0bd0d7363879a2ed228

                                                                                        SHA256

                                                                                        e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

                                                                                        SHA512

                                                                                        6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a6507273bdd91590aa129a61ca92a131\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

                                                                                        Filesize

                                                                                        187KB

                                                                                        MD5

                                                                                        ce5a621a78d7dcd08ff8ea894c827abf

                                                                                        SHA1

                                                                                        74388ed8b719fd3af29c46ca91a8f0deeb589445

                                                                                        SHA256

                                                                                        375b75ace0d33e26077b08cf114a6b428d1d80464c6fd0be24b8e402aadb02e6

                                                                                        SHA512

                                                                                        2153018344bbeef7cdc49b21a05f7f299d5c62ae0f1b3a35fcab436b7be5975d74451224d4c40fae7a0caaa5f664c0dc37d63e9b036872c542244d9c1a04b463

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                                                        Filesize

                                                                                        28KB

                                                                                        MD5

                                                                                        aefc3f3c8e7499bad4d05284e8abd16c

                                                                                        SHA1

                                                                                        7ab718bde7fdb2d878d8725dc843cfeba44a71f7

                                                                                        SHA256

                                                                                        4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

                                                                                        SHA512

                                                                                        1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\d105fa036159601f42c400bd00fa761a\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                                                        Filesize

                                                                                        180KB

                                                                                        MD5

                                                                                        0fd118e5c968df8d87568f0f35e60ef9

                                                                                        SHA1

                                                                                        50a49be4a1905912083d82458a1f6a1df8913698

                                                                                        SHA256

                                                                                        7c8d44d3cd21c170389dd9d8eaf5fe9c5d400756664691a177573df2cf7136a5

                                                                                        SHA512

                                                                                        97b6e34b132af7bc8123b147fa168df56bbd422e36bbe6433acbe737ce060927d57f79d5af118805edd21f5d77e9c0e24e69dd8cb10d9fa4752171070583f8b0

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                                                        Filesize

                                                                                        27KB

                                                                                        MD5

                                                                                        9c60454398ce4bce7a52cbda4a45d364

                                                                                        SHA1

                                                                                        da1e5de264a6f6051b332f8f32fa876d297bf620

                                                                                        SHA256

                                                                                        edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

                                                                                        SHA512

                                                                                        533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                                                        Filesize

                                                                                        57KB

                                                                                        MD5

                                                                                        6eaaa1f987d6e1d81badf8665c55a341

                                                                                        SHA1

                                                                                        e52db4ad92903ca03a5a54fdb66e2e6fad59efd5

                                                                                        SHA256

                                                                                        4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e

                                                                                        SHA512

                                                                                        dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e437943a7d58a6ed05e6767c7c8f17ad\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                                                        Filesize

                                                                                        83KB

                                                                                        MD5

                                                                                        1672aba1b8e4ad406d53f9934d5359c7

                                                                                        SHA1

                                                                                        4c3c77e67edd7ce121a54157a3d4553100f2834c

                                                                                        SHA256

                                                                                        a5327323fc132941d2f9bfda6aae03edff5dbec957e2479878ad242896f7e00e

                                                                                        SHA512

                                                                                        96f54ff1e6d71b5a0af77f92abf0feed6fcc6d73bb8b9c9b551678f86264cc9bf308d7c7774a848fb5159dae0889b56c665d3ffce5cd8456625ec1c14da9333e

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                                                        Filesize

                                                                                        130KB

                                                                                        MD5

                                                                                        2735d2ab103beb0f7c1fbd6971838274

                                                                                        SHA1

                                                                                        6063646bc072546798bf8bf347425834f2bfad71

                                                                                        SHA256

                                                                                        f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

                                                                                        SHA512

                                                                                        fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

                                                                                        Filesize

                                                                                        59KB

                                                                                        MD5

                                                                                        8c69bbdfbc8cc3fa3fa5edcd79901e94

                                                                                        SHA1

                                                                                        b8028f0f557692221d5c0160ec6ce414b2bdf19b

                                                                                        SHA256

                                                                                        a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

                                                                                        SHA512

                                                                                        825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

                                                                                        Filesize

                                                                                        42KB

                                                                                        MD5

                                                                                        71d4273e5b77cf01239a5d4f29e064fc

                                                                                        SHA1

                                                                                        e8876dea4e4c4c099e27234742016be3c80d8b62

                                                                                        SHA256

                                                                                        f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

                                                                                        SHA512

                                                                                        41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll

                                                                                        Filesize

                                                                                        855KB

                                                                                        MD5

                                                                                        7812b0a90d92b4812d4063b89a970c58

                                                                                        SHA1

                                                                                        3c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea

                                                                                        SHA256

                                                                                        897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543

                                                                                        SHA512

                                                                                        634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed

                                                                                      • C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll

                                                                                        Filesize

                                                                                        43KB

                                                                                        MD5

                                                                                        3e72bdd0663c5b2bcd530f74139c83e3

                                                                                        SHA1

                                                                                        66069bcac0207512b9e07320f4fa5934650677d2

                                                                                        SHA256

                                                                                        6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

                                                                                        SHA512

                                                                                        b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

                                                                                      • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        8f5a59be45ed9b9ad29dd54d4e0d06ed

                                                                                        SHA1

                                                                                        2c0201b2584722e1188557d7c54e4e2728c50ee4

                                                                                        SHA256

                                                                                        c821fd0c5afcf496db3d4432da818adc358a016bd922c9e6fb662f0c9f96577a

                                                                                        SHA512

                                                                                        51a55273988aa3e1000093ea68d5b32888466573af0c8511e3c7ff91fc6437c76e9b113c3b67cd7689ccbe6d7dac34ed7baf9deef918dbf74d994e16a8234c30

                                                                                      • \Windows\System32\alg.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        0ef35fa1f8ee6150ccb18a0b82b9e48f

                                                                                        SHA1

                                                                                        5c25ed13a20ba8f794053c0020523f51866a2378

                                                                                        SHA256

                                                                                        ca4c162093f98e2be3ac216ed9be8ec1e02d1d16b4fe32c7a9d0f3f97753501b

                                                                                        SHA512

                                                                                        46b2cab2859ad9f8a7168ce1cd79fb1877b83fcc9c54beec86c08c18f96456e94ef247fbea2455f09803214e78652936d11016e6c4437e32d91aeae2619401d8

                                                                                      • \Windows\System32\dllhost.exe

                                                                                        Filesize

                                                                                        1.4MB

                                                                                        MD5

                                                                                        f158e630fd259eb167a8ab7abcb8a3ed

                                                                                        SHA1

                                                                                        efb27b95bc49fff773d1019806787b127347435e

                                                                                        SHA256

                                                                                        64e3a13d5411b34c292a0b7702d87d647a07e4d612b7f12e728e252aa03b5de9

                                                                                        SHA512

                                                                                        68baedb108512a38ecf3e70fa9d27af13fd074f3bad9f8d3d9a3e22f8f0a7ffa469b555e496a5898fc665f14616c5b9e9706654944a5765f1c0b0e735218db69

                                                                                      • \Windows\System32\ieetwcollector.exe

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        97357202e6cf6f650744665ccb43701f

                                                                                        SHA1

                                                                                        b3c414086186957265e9691cbb716c5a32db9f75

                                                                                        SHA256

                                                                                        32c6fa1ab3c20603407141df8daf39b8322508690263d3ffc64cbae1635979a1

                                                                                        SHA512

                                                                                        9e69b28f6789ac77d166502512389466bf103c2f7208019f866f15d3ac15f2299a4ff79a7b233cb3424d6473cc3c10a53ed2b6ccde3c3904d29b9b65d1a0baa3

                                                                                      • \Windows\ehome\ehrecvr.exe

                                                                                        Filesize

                                                                                        1.2MB

                                                                                        MD5

                                                                                        31564dc0fee3b5c2862f8ef835663991

                                                                                        SHA1

                                                                                        7df2479c6e80623c7cdb09418015d28ffb4980a7

                                                                                        SHA256

                                                                                        cb56425090f98d6d83f1e008c05f32c92c4a350e27f24d63f85240afee08ffb5

                                                                                        SHA512

                                                                                        4e2f51afaa20cf91f3299af22885921979afd256915613e2fac8dcdf502a7ee6c87d78f19d7eed5e49a7fba0b63c16f1ea78bfda79905ac267ac9ec8c4fd12aa

                                                                                      • \Windows\ehome\ehsched.exe

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        5aaea3955ef9298c038a0958fab0fee0

                                                                                        SHA1

                                                                                        1cc52cfbbcc760487d057360e3c42dd28a7b6c9a

                                                                                        SHA256

                                                                                        a29e1bc544eb2a7c022e4ce26998dd2d6dfdd6759830fdf4adf3f0184622fc63

                                                                                        SHA512

                                                                                        f688fc3811b40c9b761d8c7ede271a8a5a637c2036c46d4f10e65a25ed9ab37ce1d91f0bd2751de2137f0b92c8e8d10c9d7e482ad48eceb1c25eadb925d8002f

                                                                                      • memory/272-137-0x0000000010000000-0x0000000010180000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/272-379-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/272-387-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/272-107-0x0000000010000000-0x0000000010180000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/272-108-0x00000000003B0000-0x0000000000417000-memory.dmp

                                                                                        Filesize

                                                                                        412KB

                                                                                      • memory/272-113-0x00000000003B0000-0x0000000000417000-memory.dmp

                                                                                        Filesize

                                                                                        412KB

                                                                                      • memory/320-104-0x0000000000200000-0x0000000000260000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/320-95-0x0000000140000000-0x000000014017E000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/320-283-0x0000000140000000-0x000000014017E000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/320-96-0x0000000000200000-0x0000000000260000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/532-334-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                        Filesize

                                                                                        5.3MB

                                                                                      • memory/532-554-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                        Filesize

                                                                                        5.3MB

                                                                                      • memory/548-620-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/548-638-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/608-657-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/608-642-0x0000000003D00000-0x0000000003DBA000-memory.dmp

                                                                                        Filesize

                                                                                        744KB

                                                                                      • memory/752-742-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/752-729-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/824-438-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/824-399-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/896-254-0x0000000000820000-0x0000000000880000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/896-796-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                        Filesize

                                                                                        1.2MB

                                                                                      • memory/896-434-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                        Filesize

                                                                                        1.2MB

                                                                                      • memory/896-252-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                        Filesize

                                                                                        1.2MB

                                                                                      • memory/1088-1041-0x0000000001F70000-0x0000000001FFC000-memory.dmp

                                                                                        Filesize

                                                                                        560KB

                                                                                      • memory/1088-1039-0x0000000001F70000-0x0000000001F8E000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                      • memory/1088-1043-0x0000000001F70000-0x000000000210E000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1088-1042-0x0000000001F70000-0x0000000002014000-memory.dmp

                                                                                        Filesize

                                                                                        656KB

                                                                                      • memory/1088-143-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1088-1046-0x0000000001F70000-0x0000000001F80000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/1088-1050-0x0000000001F70000-0x0000000001F9A000-memory.dmp

                                                                                        Filesize

                                                                                        168KB

                                                                                      • memory/1088-144-0x00000000002A0000-0x0000000000307000-memory.dmp

                                                                                        Filesize

                                                                                        412KB

                                                                                      • memory/1088-1049-0x0000000001F70000-0x0000000001F78000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/1088-1045-0x0000000001F70000-0x000000000205C000-memory.dmp

                                                                                        Filesize

                                                                                        944KB

                                                                                      • memory/1088-1040-0x0000000001F70000-0x0000000001F8A000-memory.dmp

                                                                                        Filesize

                                                                                        104KB

                                                                                      • memory/1088-1051-0x0000000001270000-0x00000000012D6000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/1088-1038-0x0000000001F70000-0x0000000001F7A000-memory.dmp

                                                                                        Filesize

                                                                                        40KB

                                                                                      • memory/1088-1047-0x0000000001F70000-0x0000000001FF8000-memory.dmp

                                                                                        Filesize

                                                                                        544KB

                                                                                      • memory/1088-342-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1088-149-0x00000000002A0000-0x0000000000307000-memory.dmp

                                                                                        Filesize

                                                                                        412KB

                                                                                      • memory/1088-1048-0x0000000001F70000-0x0000000001F94000-memory.dmp

                                                                                        Filesize

                                                                                        144KB

                                                                                      • memory/1100-730-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1100-717-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1160-666-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1160-655-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1172-718-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1536-457-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1536-489-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1544-504-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1544-491-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1616-574-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1616-556-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1700-157-0x0000000000460000-0x00000000004C0000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/1700-166-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1700-163-0x0000000000460000-0x00000000004C0000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/1736-482-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                        Filesize

                                                                                        2.2MB

                                                                                      • memory/1736-284-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                        Filesize

                                                                                        2.2MB

                                                                                      • memory/1760-770-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1760-783-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1804-581-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1824-130-0x0000000000540000-0x00000000005A0000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/1824-1077-0x0000000140000000-0x0000000140193000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1824-1131-0x0000000140000000-0x0000000140193000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1824-169-0x0000000010000000-0x0000000010188000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1824-124-0x0000000000540000-0x00000000005A0000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/1824-123-0x0000000010000000-0x0000000010188000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1824-807-0x0000000140000000-0x0000000140193000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1892-623-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1960-840-0x0000000100000000-0x0000000100193000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1960-1244-0x0000000100000000-0x0000000100193000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/1972-448-0x0000000100000000-0x0000000100176000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/1972-272-0x0000000100000000-0x0000000100176000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2332-597-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2364-440-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2364-445-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2368-786-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2368-777-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2376-827-0x0000000140000000-0x0000000140197000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2376-1160-0x0000000140000000-0x0000000140197000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2396-756-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2492-537-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2512-689-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2536-314-0x000000002E000000-0x000000002E196000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2536-530-0x000000002E000000-0x000000002E196000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2568-559-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2600-23-0x0000000100000000-0x0000000100185000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2600-253-0x0000000100000000-0x0000000100185000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2600-31-0x0000000000790000-0x00000000007F0000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/2600-34-0x0000000000790000-0x00000000007F0000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/2600-24-0x0000000000790000-0x00000000007F0000-memory.dmp

                                                                                        Filesize

                                                                                        384KB

                                                                                      • memory/2612-312-0x0000000140000000-0x00000001401AB000-memory.dmp

                                                                                        Filesize

                                                                                        1.7MB

                                                                                      • memory/2612-309-0x0000000140000000-0x00000001401AB000-memory.dmp

                                                                                        Filesize

                                                                                        1.7MB

                                                                                      • memory/2680-351-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2680-822-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2680-1493-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2680-1102-0x0000000140000000-0x000000014018F000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/2680-381-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2728-490-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                        Filesize

                                                                                        30.1MB

                                                                                      • memory/2728-298-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                        Filesize

                                                                                        30.1MB

                                                                                      • memory/2772-694-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2816-510-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2932-745-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2932-741-0x0000000000400000-0x0000000000589000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/2980-248-0x0000000000400000-0x00000000005D4000-memory.dmp

                                                                                        Filesize

                                                                                        1.8MB

                                                                                      • memory/2980-165-0x0000000000400000-0x00000000005D4000-memory.dmp

                                                                                        Filesize

                                                                                        1.8MB

                                                                                      • memory/2980-0-0x0000000000400000-0x00000000005D4000-memory.dmp

                                                                                        Filesize

                                                                                        1.8MB

                                                                                      • memory/2980-8-0x00000000002E0000-0x0000000000347000-memory.dmp

                                                                                        Filesize

                                                                                        412KB

                                                                                      • memory/2980-1-0x00000000002E0000-0x0000000000347000-memory.dmp

                                                                                        Filesize

                                                                                        412KB