Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 13:27

General

  • Target

    2024-06-16_18b4398987e0429db323d0f3f41e4c61_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    18b4398987e0429db323d0f3f41e4c61

  • SHA1

    6c2670a5785ef8ebf865328071ed4ea07f6471f0

  • SHA256

    1f1f03010a879eda414348d0f439fcce094f76a51464c8db22ca8b222033d5f1

  • SHA512

    dfa5e8ebaf40b6aa4c1f8daccb533d0c285a6eab4e0563481b46ac539407d5130abfab2c247915d6f4031cdeebf2efa78a0f294aa759d6cb8a7a6e28ecc3d514

  • SSDEEP

    12288:ivXk1qYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Ok1Xc+pFB5z+//ufNRoZW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 55 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-16_18b4398987e0429db323d0f3f41e4c61_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-16_18b4398987e0429db323d0f3f41e4c61_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2208
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2572
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2288
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2436
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 250 -NGENProcess 238 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 240 -NGENProcess 1e0 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 254 -NGENProcess 1d8 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 238 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 1e0 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1564
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 238 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1172
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 1e0 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1820
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 1d8 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 238 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2240
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 1e0 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2316
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 1d8 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2596
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 238 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2472
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 1e0 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 1d8 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 238 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2984
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 1e0 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 1d8 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 284 -NGENProcess 238 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2304
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 27c -NGENProcess 294 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:392
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 1d8 -Pipe 234 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 238 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1332
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2176
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2024
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 208 -NGENProcess 1b4 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2408
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 25c -NGENProcess 248 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1628
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 234 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1976
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 1b4 -Pipe 230 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1068
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 248 -Pipe 1c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2220
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1b4 -NGENProcess 248 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:584
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 274 -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1576
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 26c -NGENProcess 268 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2412
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 248 -Pipe 234 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2876
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 248 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 284 -NGENProcess 268 -Pipe 1b4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1612
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 268 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2820
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 28c -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1472
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
        PID:1900
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 27c -Pipe 248 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2936
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
        2⤵
          PID:772
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 268 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:752
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
          2⤵
            PID:2816
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2352
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
            2⤵
              PID:2624
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2412
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
              2⤵
                PID:1068
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:1172
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
                2⤵
                  PID:772
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 28c -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2800
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2b4 -NGENProcess 250 -Pipe 2bc -Comment "NGen Worker Process"
                  2⤵
                    PID:1716
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2c8 -NGENProcess 260 -Pipe 2c4 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2636
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b4 -NGENProcess 2ac -Pipe 2b8 -Comment "NGen Worker Process"
                    2⤵
                      PID:2248
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 208 -NGENProcess 2cc -Pipe 29c -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:3020
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 2cc -NGENProcess 2c8 -Pipe 260 -Comment "NGen Worker Process"
                      2⤵
                        PID:932
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2d8 -NGENProcess 2ac -Pipe 2c0 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:2352
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2ac -NGENProcess 208 -Pipe 2d4 -Comment "NGen Worker Process"
                        2⤵
                          PID:1040
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2d0 -NGENProcess 2dc -Pipe 2b4 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2880
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2dc -NGENProcess 2d8 -Pipe 294 -Comment "NGen Worker Process"
                          2⤵
                            PID:2404
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2e8 -NGENProcess 208 -Pipe 2cc -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2848
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 208 -NGENProcess 2d0 -Pipe 2e4 -Comment "NGen Worker Process"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:916
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2ac -Comment "NGen Worker Process"
                            2⤵
                              PID:2008
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2ec -Pipe 250 -Comment "NGen Worker Process"
                              2⤵
                                PID:584
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d0 -Pipe 2dc -Comment "NGen Worker Process"
                                2⤵
                                  PID:2984
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2188
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2ec -Pipe 2e8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1928
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2ec -NGENProcess 2f8 -Pipe 2d0 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    PID:916
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f8 -NGENProcess 208 -Pipe 2d8 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1172
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 30c -NGENProcess 304 -Pipe 2f4 -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:2100
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 304 -NGENProcess 2ec -Pipe 2c8 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1180
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 314 -NGENProcess 208 -Pipe 308 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:932
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 310 -Pipe 2f0 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2432
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2ec -Pipe 2f8 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:820
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 208 -Pipe 2fc -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2520
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 310 -Pipe 30c -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2844
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2ec -Pipe 304 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:2040
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 208 -Pipe 314 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1664
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 310 -Pipe 318 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:916
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2ec -Pipe 31c -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1748
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 208 -Pipe 320 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:772
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 310 -Pipe 324 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:3024
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2ec -Pipe 328 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:1868
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 208 -Pipe 32c -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:1700
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 310 -Pipe 330 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1968
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2ec -Pipe 334 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2404
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 208 -Pipe 338 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1180
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 310 -Pipe 33c -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:868
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2ec -Pipe 340 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1268
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 208 -Pipe 344 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2360
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 310 -Pipe 348 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1172
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 2ec -Pipe 34c -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:1576
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 208 -Pipe 350 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:912
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 310 -Pipe 354 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    PID:2408
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 310 -NGENProcess 364 -Pipe 2ec -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2436
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 374 -NGENProcess 208 -Pipe 35c -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2520
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 370 -Pipe 360 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:3020
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 364 -Pipe 368 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2432
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 208 -Pipe 358 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2848
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 370 -Pipe 36c -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:584
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 364 -Pipe 310 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1544
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 208 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1648
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 370 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:1976
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 364 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:3044
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 208 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2176
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 370 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2404
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 364 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:2100
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 208 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:912
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 370 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:944
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 364 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:1612
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 208 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1352
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 370 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2232
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 364 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:1040
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 208 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1864
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 370 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2436
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 364 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2168
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 208 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1900
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 200 -NGENProcess 3c0 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:924
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 300 -NGENProcess 3c8 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2408
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 208 -NGENProcess 3b4 -Pipe 1f8 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1180
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 3b8 -NGENProcess 3cc -Pipe 364 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2436
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3d0 -NGENProcess 3c8 -Pipe 1b0 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2520
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3b4 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1920
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3cc -Pipe 200 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2372
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3c8 -Pipe 300 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2404
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3c8 -NGENProcess 3d4 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:1900
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3e4 -NGENProcess 3cc -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2516
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3cc -NGENProcess 3dc -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:912
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3ec -NGENProcess 3d4 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2696
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3d4 -NGENProcess 3e4 -Pipe 3e8 -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1096
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3f4 -NGENProcess 3dc -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:556
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 3f0 -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2516
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3f0 -NGENProcess 3d4 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2408
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 404 -NGENProcess 3dc -Pipe 208 -Comment "NGen Worker Process"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1732
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 408 -NGENProcess 3fc -Pipe 3ec -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2948
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 40c -NGENProcess 3d4 -Pipe 3f4 -Comment "NGen Worker Process"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2388
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 410 -NGENProcess 3dc -Pipe 3cc -Comment "NGen Worker Process"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1504
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 3fc -Pipe 3f8 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2720
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 3d4 -Pipe 3f0 -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2540
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3dc -Pipe 404 -Comment "NGen Worker Process"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2164
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:544
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:2852
                                                                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          PID:532
                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2536
                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2780
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:2768
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:1956
                                                                                                                                                                        • C:\Windows\system32\dllhost.exe
                                                                                                                                                                          C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1816
                                                                                                                                                                        • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                          C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          PID:1944
                                                                                                                                                                        • C:\Windows\ehome\ehsched.exe
                                                                                                                                                                          C:\Windows\ehome\ehsched.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3016
                                                                                                                                                                        • C:\Windows\eHome\EhTray.exe
                                                                                                                                                                          "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          PID:1544
                                                                                                                                                                        • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                                          C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1296
                                                                                                                                                                        • C:\Windows\System32\msdtc.exe
                                                                                                                                                                          C:\Windows\System32\msdtc.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:1564
                                                                                                                                                                        • C:\Windows\ehome\ehRec.exe
                                                                                                                                                                          C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:1900
                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:300
                                                                                                                                                                        • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                          C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2668
                                                                                                                                                                        • C:\Windows\system32\locator.exe
                                                                                                                                                                          C:\Windows\system32\locator.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:872
                                                                                                                                                                        • C:\Windows\System32\snmptrap.exe
                                                                                                                                                                          C:\Windows\System32\snmptrap.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1896
                                                                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                                                                          C:\Windows\System32\vds.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1136
                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:2652
                                                                                                                                                                        • C:\Windows\system32\wbengine.exe
                                                                                                                                                                          "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:2476
                                                                                                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2756
                                                                                                                                                                        • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                          "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:2148
                                                                                                                                                                        • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:392
                                                                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:1752
                                                                                                                                                                          • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                                            "C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                            PID:1168
                                                                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:640

                                                                                                                                                                        Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                                                                                                                                                          Filesize

                                                                                                                                                                          706KB

                                                                                                                                                                          MD5

                                                                                                                                                                          b84f570ae1e641a1b3f5efac4b22b538

                                                                                                                                                                          SHA1

                                                                                                                                                                          d513f21d20f9cdcd7a4f8f36be6ff67dce7b1796

                                                                                                                                                                          SHA256

                                                                                                                                                                          a51cf716a9bc49cbde5a69c1c477af92764bb33c40d267277cdf0b3847f9434d

                                                                                                                                                                          SHA512

                                                                                                                                                                          97c81b89190afba242d0f57ee1b74b22def7cbcfd2dd463f958c5b7e369484daff8223334521cc19adef299d6aeef7dd1e44d1115adad4228607687289b4afe2

                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                                                                                                                                                          Filesize

                                                                                                                                                                          30.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          671555aa2dc5e671ead225a462795636

                                                                                                                                                                          SHA1

                                                                                                                                                                          cde9282c7deca3107adbbdca8d96ce8a388f3e22

                                                                                                                                                                          SHA256

                                                                                                                                                                          5c0502b098708aae06ce4b28879583873d6a570435e3715fe443f33a61aa7dfc

                                                                                                                                                                          SHA512

                                                                                                                                                                          05b2be0cb42907b02ab41bdef49975220e788829c3f9471896b0a345e0d6a4dacc85887b2168fa777d188320a09a7386043d5caf975039684426eb57c4e29e86

                                                                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          781KB

                                                                                                                                                                          MD5

                                                                                                                                                                          11e20f5177d063c3eadc574c0494bfd8

                                                                                                                                                                          SHA1

                                                                                                                                                                          6221e0ec4e97a85cdfa4e3498034f4c17e5fc6c3

                                                                                                                                                                          SHA256

                                                                                                                                                                          5ece0c9d131cfcb271fd1e5c6209ae24667256cf983ec5188001ffc59da0c890

                                                                                                                                                                          SHA512

                                                                                                                                                                          b8fc5c605c7154554fe90a75d33cefa977832fc9685b9f2c26332af37ced305fe1f20e3f56e10edce56c1a1a7cf2eb67af357484debe830b5bdb33d8d28839b6

                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.2MB

                                                                                                                                                                          MD5

                                                                                                                                                                          0a3309b7c416bbe2991db35c8da501b4

                                                                                                                                                                          SHA1

                                                                                                                                                                          1e960ee3889ece08a06f320258b01b7612b44c38

                                                                                                                                                                          SHA256

                                                                                                                                                                          cb3f2fcd5e1fbb6f258228d5164260a90ce2309a96f577989cabbe3c6421ff94

                                                                                                                                                                          SHA512

                                                                                                                                                                          2ed2435fb566490a24ca193d34410712fb6ba6b7b54df99df034d4316ad2a762f1a5a3f14efc5e9808d7955eaed1fb6129b10fb0abdf875cee3e27e4ee3f698e

                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          f342c80dbe023e210b730597ec89e583

                                                                                                                                                                          SHA1

                                                                                                                                                                          653939aa5d103c391ba85c872cfacde3d51a90f4

                                                                                                                                                                          SHA256

                                                                                                                                                                          1e2976bb284089ea0d4df9d9b9277d49cf4d85049d955b8edf4ca2b474c3999e

                                                                                                                                                                          SHA512

                                                                                                                                                                          483b4746fcdc086ba6b99192cf2f2cd4cd7344a3674bf7497debeb054f9a2b01e5cc4d22b6211951f380149990a1497748a43cf262ea445b4d00c50a9dc6738f

                                                                                                                                                                        • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          1024KB

                                                                                                                                                                          MD5

                                                                                                                                                                          6055cf892a89d7a80ac91f0125a0a6fa

                                                                                                                                                                          SHA1

                                                                                                                                                                          5af1dedba22b09023d03de76835bc4768bc83c6c

                                                                                                                                                                          SHA256

                                                                                                                                                                          c7ce31c965c402bd66d9dc2e42f0bcc29779308c94a2d0885da493349d464b99

                                                                                                                                                                          SHA512

                                                                                                                                                                          cc37c0078e792b93ac75d4dc4469dab3cfde4dfe9c64af8a4c0284b183f9ea9949baf11b3cef646e778af91ea9b7f4fe4d82a531098cac595ffbe335a841ed6c

                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

                                                                                                                                                                          Filesize

                                                                                                                                                                          24B

                                                                                                                                                                          MD5

                                                                                                                                                                          b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                                          SHA1

                                                                                                                                                                          9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                                          SHA256

                                                                                                                                                                          7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                                          SHA512

                                                                                                                                                                          cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          648KB

                                                                                                                                                                          MD5

                                                                                                                                                                          14b043be11b0067cb926969452e3c44b

                                                                                                                                                                          SHA1

                                                                                                                                                                          a2b96f1e72766aca651f097cfdf71fe73cefae14

                                                                                                                                                                          SHA256

                                                                                                                                                                          2ed5dd21101245fa38fb042018e36d3b64413ad946a88b151c77555c57afcbde

                                                                                                                                                                          SHA512

                                                                                                                                                                          0f5d7415837dc320a5db6e4e31e08b68ca3f464bfd17df5499debde5c155483f24718938352bfd605f06d056ddb398d1c8cd4e34f91ca75d3c1d51f55a7e1675

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          872KB

                                                                                                                                                                          MD5

                                                                                                                                                                          91fcf811de50d9fc59e88f8a21292ae5

                                                                                                                                                                          SHA1

                                                                                                                                                                          846752a8e34758a844a56f514e9559ae2b642010

                                                                                                                                                                          SHA256

                                                                                                                                                                          245886b1c7b600ad0d034b4cf6997fe6bde97d2e5cc6b4aab3d0e7a92419270c

                                                                                                                                                                          SHA512

                                                                                                                                                                          156c31ba0c68ccc8d6298c29dfc9d26fb1fdb62164f4ca4018e658abbd4d10eda4accfeef2300d09eb23bfec38eb2fb2af8a914d25709e5481f45d5ab11950a4

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          603KB

                                                                                                                                                                          MD5

                                                                                                                                                                          1cc506c7fbb25fb99b894e1c68fcf3fd

                                                                                                                                                                          SHA1

                                                                                                                                                                          0d98269fd8535548e155081375484268b68ba6b0

                                                                                                                                                                          SHA256

                                                                                                                                                                          479f3f894bdd4fe195b48fb02d2bc1013bb5428620aa089feef489d93853da06

                                                                                                                                                                          SHA512

                                                                                                                                                                          944e51170a57f61ccab99a8cb5c515217185968830cf437b317573d72bbf7a017fe81d3252d9a8bc48f6f5de0ad666545db5aa5bdbf3b19607f6d7a242b5e000

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          678KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fc535ee6b80354948d2682f9fb7f4469

                                                                                                                                                                          SHA1

                                                                                                                                                                          b8bcd09a52d49c1a6d83c858cb819f9403bf2534

                                                                                                                                                                          SHA256

                                                                                                                                                                          d0be66a0a6fc2f0064b79ecc1433b8bab09ba6ccf69c97530324af343a42423d

                                                                                                                                                                          SHA512

                                                                                                                                                                          7b3d7dc6cfad834a1eed623123f7f817a63bc3573dc5eace6f2f9b7516f01cb9230aacf0a0c29bfc44086924f3de381813ede1010f254c3f52dae0d1ec8757af

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          8KB

                                                                                                                                                                          MD5

                                                                                                                                                                          e4f0d28c2636b4945a16bba918e4fda9

                                                                                                                                                                          SHA1

                                                                                                                                                                          67b96644de08c65f1443d9f0ed60b4a62b811311

                                                                                                                                                                          SHA256

                                                                                                                                                                          5a9911954d90a80a1079a854e8d6d6b2421c9493cf90320f822fcc7c651d671f

                                                                                                                                                                          SHA512

                                                                                                                                                                          1b48be9115e18c49f301e8ef39dc4327203246599a13480225d69b77153fb2b853e1b5eab88457034659bb8b0e8883b01a37b52206b674c0f979b8b32bc55220

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          625KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ff26f1916e69485339cba2599b05ef48

                                                                                                                                                                          SHA1

                                                                                                                                                                          1eccb27559c6e226226df07eae1e3ebc5b78a126

                                                                                                                                                                          SHA256

                                                                                                                                                                          25e962bd498d0a593963ce5f30b718eb8e2103fedd1a25cd2d69a53a52ff3323

                                                                                                                                                                          SHA512

                                                                                                                                                                          536f448a3ab012f0153ce0c9266a963b4983653725658ddd76f51e68ffa782423429a7ee99400b832df3f05741067a61b8e1ec483c9d5eb570002a245d167424

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          1003KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb59024df005ba964b6a57401813cbd9

                                                                                                                                                                          SHA1

                                                                                                                                                                          59b5744c621f99cbaff50e6b199c1ee4aa8ed573

                                                                                                                                                                          SHA256

                                                                                                                                                                          b5a0c46b486f839dd4b171f5b9d9727d13e198178229b31a6beceabefc7016da

                                                                                                                                                                          SHA512

                                                                                                                                                                          9773cc0a52d75a27be7b952c5befd233fe9c966c60eb45add27c35bf6324cf6aa1179d8207faec4f2852af98389d4fdb6a1faeb9611715c31e2ef7204df09b7e

                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          656KB

                                                                                                                                                                          MD5

                                                                                                                                                                          c95880bdf42b3379a6f7c7e2093b74cd

                                                                                                                                                                          SHA1

                                                                                                                                                                          d53903a8e3caff3ac1e62b28df636575bb986feb

                                                                                                                                                                          SHA256

                                                                                                                                                                          ccb1071f1d8af00267d08353a3a93ab440d54427b874405c85fb09dfbcf388e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          8f9255f1800cb596508acc66299118930fc949db3baf5755ff1b1d4e0efb325f46378c6876f9322b8edef0dc574659d4393f81000377aa6a63025828b95c6a14

                                                                                                                                                                        • C:\Windows\SysWOW64\perfhost.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          587KB

                                                                                                                                                                          MD5

                                                                                                                                                                          8a2ca819e735282c604fa2e1209cbeb9

                                                                                                                                                                          SHA1

                                                                                                                                                                          2c1aeb769762736fc4b0e51f7658012bd37b177d

                                                                                                                                                                          SHA256

                                                                                                                                                                          abe0a91b5f239afe6eb869b35776bd670d0b77f69facc6d22ae58aac3bd7e912

                                                                                                                                                                          SHA512

                                                                                                                                                                          0d09e0dd150a198c7e30446562dc797057617177bf55c908efe1fc8315407b716e7878e86d3c2f635ba25f1efa82987b1035081e64421f9df8a8301ba6ec6e15

                                                                                                                                                                        • C:\Windows\System32\ieetwcollector.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          674KB

                                                                                                                                                                          MD5

                                                                                                                                                                          99123168d9967f63c408dfc2860e5c9b

                                                                                                                                                                          SHA1

                                                                                                                                                                          64f94dcadc03fb3fd4d4b174313fb1d949851ecc

                                                                                                                                                                          SHA256

                                                                                                                                                                          49f48fdd96c4c89849d493981b63b59e5d875b9c18707e4a1a8beef15004e21f

                                                                                                                                                                          SHA512

                                                                                                                                                                          4b3626d6c04f0206d7c52ecd79a4de7e3a762ab9b7b7fe8a62a85d6e2c4337e370240d9f6be03bb94e35bbec9c99673e83aabea1799e0042217b910fb5281ea7

                                                                                                                                                                        • C:\Windows\System32\msdtc.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          705KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3aa7eeded2887755c029c5da591e7ffc

                                                                                                                                                                          SHA1

                                                                                                                                                                          4a79358eba3299af109e8249128cbab4b6dadcb4

                                                                                                                                                                          SHA256

                                                                                                                                                                          66feeead5b0f4ad03b2000c7b30ee93183bebd39433e74b641004a479b099973

                                                                                                                                                                          SHA512

                                                                                                                                                                          4ea92bdbd31ff5c991476e1fd1e3b995f0ec5db4dfd3a52f5a953807faf1f30a65db341b773411874b293d0d50bb7b022c0f3f847d9900b3b224606d5730e538

                                                                                                                                                                        • C:\Windows\System32\snmptrap.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          581KB

                                                                                                                                                                          MD5

                                                                                                                                                                          d73622823d8848e46fe829b8e0f67910

                                                                                                                                                                          SHA1

                                                                                                                                                                          28a96b6e992587516edea8d22602a9ab255e3eef

                                                                                                                                                                          SHA256

                                                                                                                                                                          da0d55fcf302727b5ad0d7912475b9463efde72293cf2219bd09c46cd8b14bec

                                                                                                                                                                          SHA512

                                                                                                                                                                          1f55adbcc1148dc96d1ae92562d4372ffbe5d72104acf63a1e26c69b0b0ab114f83739005b67b6aea93d3605009afa25de6fdc893521689e60730898a5d49684

                                                                                                                                                                        • C:\Windows\System32\vds.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          41aee21b074863e96e69a849bc34174d

                                                                                                                                                                          SHA1

                                                                                                                                                                          caf4e3077ec7f8ce16a780d810fb60f36dc70e6f

                                                                                                                                                                          SHA256

                                                                                                                                                                          eca179b91da89ab1cd4c7ed86861e9cc7e852d97e9d69e506656e36629b0b025

                                                                                                                                                                          SHA512

                                                                                                                                                                          d35fee651f53468f4206fbf590043475ae883e2178dc4515e7456fc9e56bee7bf07c9482b0eec966ee1da9a3b5dd58508722b8de9de3097d761822b40752f9fb

                                                                                                                                                                        • C:\Windows\Temp\Cab59C4.tmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          29KB

                                                                                                                                                                          MD5

                                                                                                                                                                          d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                                                          SHA1

                                                                                                                                                                          e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                                                          SHA256

                                                                                                                                                                          a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                                                          SHA512

                                                                                                                                                                          17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                                                        • C:\Windows\Temp\Tar5D6E.tmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          81KB

                                                                                                                                                                          MD5

                                                                                                                                                                          b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                                                          SHA1

                                                                                                                                                                          7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                                                          SHA256

                                                                                                                                                                          725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                                                          SHA512

                                                                                                                                                                          f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          105KB

                                                                                                                                                                          MD5

                                                                                                                                                                          d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                                          SHA1

                                                                                                                                                                          9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                                          SHA256

                                                                                                                                                                          dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                                          SHA512

                                                                                                                                                                          5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          7835e60e560a49049ae728698da3d301

                                                                                                                                                                          SHA1

                                                                                                                                                                          87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

                                                                                                                                                                          SHA256

                                                                                                                                                                          df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

                                                                                                                                                                          SHA512

                                                                                                                                                                          b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          238KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0a4ed78b7995d94fa42379f84cd5f8e9

                                                                                                                                                                          SHA1

                                                                                                                                                                          90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

                                                                                                                                                                          SHA256

                                                                                                                                                                          0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

                                                                                                                                                                          SHA512

                                                                                                                                                                          86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          248KB

                                                                                                                                                                          MD5

                                                                                                                                                                          4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                                          SHA1

                                                                                                                                                                          f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                                          SHA256

                                                                                                                                                                          c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                                          SHA512

                                                                                                                                                                          c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.8MB

                                                                                                                                                                          MD5

                                                                                                                                                                          9958f23efa2a86f8195f11054f94189a

                                                                                                                                                                          SHA1

                                                                                                                                                                          78ec93b44569ea7ebce452765568da5c73511931

                                                                                                                                                                          SHA256

                                                                                                                                                                          3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

                                                                                                                                                                          SHA512

                                                                                                                                                                          3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.0MB

                                                                                                                                                                          MD5

                                                                                                                                                                          598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                                                          SHA1

                                                                                                                                                                          5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                                                          SHA256

                                                                                                                                                                          e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                                                          SHA512

                                                                                                                                                                          774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          58KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3d6987fc36386537669f2450761cdd9d

                                                                                                                                                                          SHA1

                                                                                                                                                                          7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                                          SHA256

                                                                                                                                                                          34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                                          SHA512

                                                                                                                                                                          1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          205KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0a41e63195a60814fe770be368b4992f

                                                                                                                                                                          SHA1

                                                                                                                                                                          d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                                          SHA256

                                                                                                                                                                          4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                                          SHA512

                                                                                                                                                                          1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\25cb54809e3903c5ca051af824bf9ca9\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          221KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9ab1dfd60e07f5bb67e2892ab12cc11a

                                                                                                                                                                          SHA1

                                                                                                                                                                          8303733edd9dc17cfa416ae69ed993d736c062aa

                                                                                                                                                                          SHA256

                                                                                                                                                                          11c911afc4e32edf1b701094c4056e901ed96c95aeb6bd2bfbccc59369ca4757

                                                                                                                                                                          SHA512

                                                                                                                                                                          de0f74c2f60ebf69bafc44ed621a328c6a19056a6b18e4cb4d071a4e6b9d26e6dc6782d5ef3fcd2b6ae1bb92642bbb09da045b94ce5ab8b5bbd601bf3693b937

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          43KB

                                                                                                                                                                          MD5

                                                                                                                                                                          68c51bcdc03e97a119431061273f045a

                                                                                                                                                                          SHA1

                                                                                                                                                                          6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                                          SHA256

                                                                                                                                                                          4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                                          SHA512

                                                                                                                                                                          d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          198KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                                          SHA1

                                                                                                                                                                          ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                                          SHA256

                                                                                                                                                                          469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                                          SHA512

                                                                                                                                                                          58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          70KB

                                                                                                                                                                          MD5

                                                                                                                                                                          57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                                          SHA1

                                                                                                                                                                          da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                                          SHA256

                                                                                                                                                                          1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                                          SHA512

                                                                                                                                                                          1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          87KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                                          SHA1

                                                                                                                                                                          4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                                          SHA256

                                                                                                                                                                          b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                                          SHA512

                                                                                                                                                                          d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\94193c68e2c220f42829e2fde3ec84ad\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          122KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9c06a13f1c1c38513e98ab9cf814afba

                                                                                                                                                                          SHA1

                                                                                                                                                                          c3f55f38763567969fb59d72a4e0a71bced3e079

                                                                                                                                                                          SHA256

                                                                                                                                                                          53e02e0e3b07970173bf8f8f0d61565c52c921f2981e7099db618a3f1965f75c

                                                                                                                                                                          SHA512

                                                                                                                                                                          c1c2ba8f96b51902091676b8b1d5e8d3c8e752a697ba3a7797fe9c01ff15fdb8424bd82d1840ec0bd3fcc1e3cb3c784f4a13d83b679ec7d5ce7041f3b7200ef6

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9879402151f135a82d663bcf4dfe9a60\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          305KB

                                                                                                                                                                          MD5

                                                                                                                                                                          01edf5b43db8e61f8a3e4f32de58398a

                                                                                                                                                                          SHA1

                                                                                                                                                                          87c62097b57f33031273c884c5a9a831f667a9e6

                                                                                                                                                                          SHA256

                                                                                                                                                                          e162c21019ab2ea408b766748993328ada062972b722449471dcfd95b32c5f91

                                                                                                                                                                          SHA512

                                                                                                                                                                          9e7d1bf1301e276d6ae5dc89c9fc59948adf99146d9d6a05a9f415a2d7a46766da804b3de2849fd0c55451bbfbfe3ca08e0f640e03eca77d50741bb647475e78

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          82KB

                                                                                                                                                                          MD5

                                                                                                                                                                          2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                                          SHA1

                                                                                                                                                                          66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                                          SHA256

                                                                                                                                                                          37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                                          SHA512

                                                                                                                                                                          cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          58KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                                          SHA1

                                                                                                                                                                          500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                                          SHA256

                                                                                                                                                                          1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                                          SHA512

                                                                                                                                                                          b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          85KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                                          SHA1

                                                                                                                                                                          dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                                          SHA256

                                                                                                                                                                          d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                                          SHA512

                                                                                                                                                                          27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          298KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                                          SHA1

                                                                                                                                                                          1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                                          SHA256

                                                                                                                                                                          5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                                          SHA512

                                                                                                                                                                          58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\f8bbadc517a03c8ffa0d87fe74473565\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          271KB

                                                                                                                                                                          MD5

                                                                                                                                                                          2d353cddb0cc3d3d7f58a9639f52d072

                                                                                                                                                                          SHA1

                                                                                                                                                                          a26b07556fcf7856ea0a862f40ae2c3d5a63721d

                                                                                                                                                                          SHA256

                                                                                                                                                                          a7dcac043b09de8ff8ac32b5c001650b5f4e7a11032712f5290687b220954317

                                                                                                                                                                          SHA512

                                                                                                                                                                          4e3f5f26475da9fb24bcae105c3c0fca590389b7f444ba542f3d691d2fa5d7e36230bf7ef3c90a16115bb284df8cb6c949389f48f7979dd5d9f65a65ffa3b28e

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          43KB

                                                                                                                                                                          MD5

                                                                                                                                                                          dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                                          SHA1

                                                                                                                                                                          d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                                          SHA256

                                                                                                                                                                          f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                                          SHA512

                                                                                                                                                                          8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          124KB

                                                                                                                                                                          MD5

                                                                                                                                                                          929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                                          SHA1

                                                                                                                                                                          993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                                          SHA256

                                                                                                                                                                          2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                                          SHA512

                                                                                                                                                                          effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          10b5a285eafccdd35390bb49861657e7

                                                                                                                                                                          SHA1

                                                                                                                                                                          62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                                          SHA512

                                                                                                                                                                          19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          88KB

                                                                                                                                                                          MD5

                                                                                                                                                                          1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                                          SHA1

                                                                                                                                                                          4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                                          SHA256

                                                                                                                                                                          9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                                          SHA512

                                                                                                                                                                          e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                                                        • C:\Windows\ehome\ehrecvr.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.2MB

                                                                                                                                                                          MD5

                                                                                                                                                                          2f3e94680cdce1e0e34040d0a0fc0bae

                                                                                                                                                                          SHA1

                                                                                                                                                                          5894ae07878f958173f94ee94cdba878c847f892

                                                                                                                                                                          SHA256

                                                                                                                                                                          87e8aeb22ac1037744f7efe29c3c95be22702e053c8ec6e70639d2d286781c4d

                                                                                                                                                                          SHA512

                                                                                                                                                                          3dd62cfc8918efbd517ea688fead57132735a5124f7104a1fb480a08094ccbdc2307f808c7497f3674f8f05b95af3a3af340b478f7f8570bbba376a34ce75961

                                                                                                                                                                        • C:\Windows\ehome\ehsched.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          691KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0017a0758c471cb902b1d7ebb19dc22c

                                                                                                                                                                          SHA1

                                                                                                                                                                          64b280a44acf5f44662207bde5a0c6d453998bc5

                                                                                                                                                                          SHA256

                                                                                                                                                                          f68134cb8d7f8aca6c48be89c242c6451dcb6b46bf8828340bcc654c2c12e221

                                                                                                                                                                          SHA512

                                                                                                                                                                          424f42f6e4d6bcc39413f37ce7e65e7f9bc565e8e906b061fadd803824a785d1ccff9c684333dcb55588fa116ff9727415e61998d7c86717977df9ae49abd8f0

                                                                                                                                                                        • \Windows\System32\Locator.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          577KB

                                                                                                                                                                          MD5

                                                                                                                                                                          421dcdcb96b40ea53dbb1f7c07906d61

                                                                                                                                                                          SHA1

                                                                                                                                                                          f9a76ae8e716a74a8b40c1cd9d3722db0128af39

                                                                                                                                                                          SHA256

                                                                                                                                                                          27e4451ffc39f12e0bdeef55f3d5557376cf529931cd622cff7aa38e1141f59c

                                                                                                                                                                          SHA512

                                                                                                                                                                          dbfad5cb631cf450d2b739d9ffe5047ccec6e58294c6d6f67d080cfe64b9b0b6b100e02bc2dd64591416ff77fcf4258726bad13d8784ba5736ba5517da2c4441

                                                                                                                                                                        • \Windows\System32\alg.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          644KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5804760750d614893e1af0486be599be

                                                                                                                                                                          SHA1

                                                                                                                                                                          251b38db0d6cc5964bbf513dbfb711a77dafe131

                                                                                                                                                                          SHA256

                                                                                                                                                                          8d97a005518ec91bd6aaf3b905becaf8199897a034a62dd964d58676ca6527d4

                                                                                                                                                                          SHA512

                                                                                                                                                                          c41d330afe2beaeca3b69cce9305633cdda1ed3ad5f71f94dad552674bb53e565f62d8949aaa46b708c5a19f26a658bafb2711576eb7733032c61db8325b96ff

                                                                                                                                                                        • \Windows\System32\dllhost.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          577KB

                                                                                                                                                                          MD5

                                                                                                                                                                          46f7485f98e16a8e7a911293b116b36d

                                                                                                                                                                          SHA1

                                                                                                                                                                          538a903422a9ad2391c98ce4afc01851044595c8

                                                                                                                                                                          SHA256

                                                                                                                                                                          400770691829008593780d67ac1ebe8d92d1c8e2252ce8a358a0b413c0c21643

                                                                                                                                                                          SHA512

                                                                                                                                                                          1ed374cfe28ced811359939ec72c14c55081a966c6a6658e23a03608f9dc883788a275679c57bee8a1ada1dadff44e4cc58eff3d94b2aac1efa905bcee758790

                                                                                                                                                                        • \Windows\System32\msiexec.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          691KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9f5932677eafe9d5d33158210e200e14

                                                                                                                                                                          SHA1

                                                                                                                                                                          1023dcc2b3927cd8f9c06e25dbcec7342bfcf78a

                                                                                                                                                                          SHA256

                                                                                                                                                                          e5788910d238542de5ad1566db1e6d8c41cfe3cf16a68c2253598585f3db6bcc

                                                                                                                                                                          SHA512

                                                                                                                                                                          4df7ebbc44338cfc5c4031d325d50c347855772d6a72196fdebd421cb353e085e86c457875e97c442582175b99435834aafaff45c9b1a80fb28cec28cd0d1dad

                                                                                                                                                                        • memory/300-908-0x0000000000600000-0x00000000006B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          712KB

                                                                                                                                                                        • memory/300-806-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          712KB

                                                                                                                                                                        • memory/300-704-0x0000000000600000-0x00000000006B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          712KB

                                                                                                                                                                        • memory/300-700-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          712KB

                                                                                                                                                                        • memory/392-815-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.1MB

                                                                                                                                                                        • memory/392-567-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/520-519-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/520-499-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/532-101-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          808KB

                                                                                                                                                                        • memory/532-98-0x00000000008E0000-0x0000000000940000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/532-92-0x00000000008E0000-0x0000000000940000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/532-115-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          808KB

                                                                                                                                                                        • memory/544-71-0x00000000002F0000-0x0000000000350000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/544-77-0x00000000002F0000-0x0000000000350000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/544-79-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.2MB

                                                                                                                                                                        • memory/544-345-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.2MB

                                                                                                                                                                        • memory/872-727-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          596KB

                                                                                                                                                                        • memory/872-915-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          596KB

                                                                                                                                                                        • memory/1104-346-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1104-334-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1136-757-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.1MB

                                                                                                                                                                        • memory/1172-405-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1172-416-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1272-364-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1272-360-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1296-680-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/1296-792-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/1332-579-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1332-589-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1532-433-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1532-439-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1564-687-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          728KB

                                                                                                                                                                        • memory/1564-404-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1564-400-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1564-795-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          728KB

                                                                                                                                                                        • memory/1600-578-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1652-365-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1652-382-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1816-750-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          596KB

                                                                                                                                                                        • memory/1816-629-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          596KB

                                                                                                                                                                        • memory/1820-427-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1896-747-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          600KB

                                                                                                                                                                        • memory/1936-534-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/1944-762-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.2MB

                                                                                                                                                                        • memory/1944-643-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.2MB

                                                                                                                                                                        • memory/1956-610-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          668KB

                                                                                                                                                                        • memory/1956-655-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          668KB

                                                                                                                                                                        • memory/2024-310-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/2024-302-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/2092-387-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2092-391-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2148-804-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/2176-305-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/2176-291-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/2208-1-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          412KB

                                                                                                                                                                        • memory/2208-24-0x0000000000400000-0x00000000004B0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          704KB

                                                                                                                                                                        • memory/2208-8-0x0000000000400000-0x00000000004B0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          704KB

                                                                                                                                                                        • memory/2208-7-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          412KB

                                                                                                                                                                        • memory/2208-0-0x0000000000400000-0x00000000004B0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          704KB

                                                                                                                                                                        • memory/2240-451-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2240-447-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2288-30-0x0000000000980000-0x00000000009E0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/2288-118-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          628KB

                                                                                                                                                                        • memory/2288-38-0x0000000000980000-0x00000000009E0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/2288-29-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          628KB

                                                                                                                                                                        • memory/2304-556-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2316-457-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2316-471-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2436-322-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2436-333-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2472-476-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2472-493-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2476-782-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/2536-106-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          412KB

                                                                                                                                                                        • memory/2536-105-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          724KB

                                                                                                                                                                        • memory/2536-386-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          724KB

                                                                                                                                                                        • memory/2556-314-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/2556-54-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          696KB

                                                                                                                                                                        • memory/2556-55-0x0000000000360000-0x00000000003C0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/2556-63-0x0000000000360000-0x00000000003C0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/2572-16-0x0000000000910000-0x0000000000970000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/2572-22-0x0000000000910000-0x0000000000970000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                        • memory/2572-13-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          656KB

                                                                                                                                                                        • memory/2572-100-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          656KB

                                                                                                                                                                        • memory/2596-463-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2596-475-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2652-496-0x0000000003BE0000-0x0000000003C9A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          744KB

                                                                                                                                                                        • memory/2652-771-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.1MB

                                                                                                                                                                        • memory/2652-508-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2652-495-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2668-914-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          600KB

                                                                                                                                                                        • memory/2668-716-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          600KB

                                                                                                                                                                        • memory/2728-41-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2728-47-0x0000000000A20000-0x0000000000A87000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          412KB

                                                                                                                                                                        • memory/2728-42-0x0000000000A20000-0x0000000000A87000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          412KB

                                                                                                                                                                        • memory/2728-282-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2756-793-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          784KB

                                                                                                                                                                        • memory/2768-625-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          636KB

                                                                                                                                                                        • memory/2768-594-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          636KB

                                                                                                                                                                        • memory/2780-399-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.3MB

                                                                                                                                                                        • memory/2780-128-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.3MB

                                                                                                                                                                        • memory/2852-347-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          30.1MB

                                                                                                                                                                        • memory/2852-90-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          30.1MB

                                                                                                                                                                        • memory/2852-82-0x0000000000510000-0x0000000000577000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          412KB

                                                                                                                                                                        • memory/2852-87-0x0000000000510000-0x0000000000577000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          412KB

                                                                                                                                                                        • memory/2864-352-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2864-348-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/2984-528-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/3016-545-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                        • memory/3016-665-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          712KB

                                                                                                                                                                        • memory/3016-773-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          712KB