Overview

overview

7

Static

static

3

4a61ce9f23...cs.exe

windows7-x64

7

4a61ce9f23...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a61ce9f23261a039ed989bb0bfb780cc58899f241e19911d24ca5377dd95a43_NeikiAnalytics.exe

  • Size

    648KB

  • MD5

    105eaf439689f098ea3d237fba2bd7b0

  • SHA1

    894a531087e8a31992487f2c39040d418cdf1b24

  • SHA256

    4a61ce9f23261a039ed989bb0bfb780cc58899f241e19911d24ca5377dd95a43

  • SHA512

    3eb4cb8e68074543e4bc1c7ddb621b2dd0dbcdd7bb1dde76dd92d280a7d7156aa2a6350aa75bd4d4141ba2ece032971fc399f688f26a212ff6785baec8168684

  • SSDEEP

    12288:iqz2DWUH3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Lz2DWm1N3RUDHNmdPCAaq8Nozgi/rE08

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 55 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a61ce9f23261a039ed989bb0bfb780cc58899f241e19911d24ca5377dd95a43_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4a61ce9f23261a039ed989bb0bfb780cc58899f241e19911d24ca5377dd95a43_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2980
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2956
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2696
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2540
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1200
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1724
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1632
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1f0 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2684
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 240 -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1076
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 260 -NGENProcess 1d4 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:924
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 24c -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 1d4 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 264 -NGENProcess 274 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2240
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1f0 -NGENProcess 1d4 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 278 -NGENProcess 26c -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1848
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 26c -NGENProcess 270 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 260 -NGENProcess 27c -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 278 -NGENProcess 288 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1788
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 24c -NGENProcess 27c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 28c -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1464
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 288 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 27c -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 260 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2560
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 28c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:560
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 260 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2a4 -NGENProcess 2a0 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2136
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1920
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1872
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1c0 -NGENProcess 244 -Pipe 1b4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1668
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 260 -NGENProcess 238 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2664
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 250 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1788
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 244 -Pipe 234 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1516
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 238 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2500
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 244 -NGENProcess 238 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2276
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1f8 -NGENProcess 254 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2372
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 254 -NGENProcess 278 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3056
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 264 -NGENProcess 274 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1972
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 274 -NGENProcess 1f8 -Pipe 1c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1052
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1f8 -NGENProcess 1fc -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2964
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 1fc -NGENProcess 26c -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1552
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 288 -NGENProcess 280 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1680
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 280 -NGENProcess 1f8 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
        PID:1488
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 290 -NGENProcess 26c -Pipe 274 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2932
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 26c -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"
        2⤵
          PID:752
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 298 -NGENProcess 1f8 -Pipe 1fc -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2820
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 1f8 -NGENProcess 290 -Pipe 278 -Comment "NGen Worker Process"
          2⤵
            PID:1628
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 280 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1472
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 288 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
            2⤵
              PID:1712
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a8 -NGENProcess 290 -Pipe 26c -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1408
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 290 -NGENProcess 2a0 -Pipe 2a4 -Comment "NGen Worker Process"
              2⤵
                PID:1088
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2b0 -NGENProcess 294 -Pipe 1f8 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:1352
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 294 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
                2⤵
                  PID:2292
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b8 -NGENProcess 2a0 -Pipe 288 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1556
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2a0 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
                  2⤵
                    PID:1144
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 2a8 -Pipe 290 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:1516
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a8 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
                    2⤵
                      PID:2440
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 294 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:1488
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
                      2⤵
                        PID:3048
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 2a0 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:3056
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2b8 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
                        2⤵
                          PID:2512
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 2a8 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:1748
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
                          2⤵
                            PID:1992
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 2c8 -Pipe 2b0 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2328
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:1716
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
                            2⤵
                              PID:1792
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2e4 -Pipe 29c -Comment "NGen Worker Process"
                              2⤵
                                PID:1260
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2c0 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2216
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2d0 -Pipe 250 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:704
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2f4 -NGENProcess 2f0 -Pipe 2e4 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1088
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2d0 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1716
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2e8 -NGENProcess 2c8 -Pipe 2ec -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1844
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 304 -NGENProcess 2e0 -Pipe 2fc -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      PID:2116
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 300 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:2328
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 30c -NGENProcess 2c8 -Pipe 2f4 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2664
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 308 -Pipe 23c -Comment "NGen Worker Process"
                                          2⤵
                                            PID:928
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2544
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2c8 -Pipe 2f8 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1600
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 308 -Pipe 304 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:824
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2f0 -Pipe 2e0 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1392
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2c8 -Pipe 30c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2932
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 324 -NGENProcess 320 -Pipe 308 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2516
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 310 -NGENProcess 2c8 -Pipe 314 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2668
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 318 -NGENProcess 31c -Pipe 334 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2120
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 2d8 -NGENProcess 330 -Pipe 32c -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1980
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 338 -NGENProcess 2c8 -Pipe 2f0 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2116
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 31c -Pipe 328 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2800
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 330 -Pipe 324 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2328
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2c8 -Pipe 310 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2704
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 31c -Pipe 318 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1560
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 330 -Pipe 2d8 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:288
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 344 -NGENProcess 354 -Pipe 348 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:1180
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 338 -NGENProcess 330 -Pipe 33c -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1160
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 358 -NGENProcess 34c -Pipe 320 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:928
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 354 -Pipe 340 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1516
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 330 -Pipe 2c8 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:772
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 34c -Pipe 350 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                  • Loads dropped DLL
                                                                                  • Drops file in Windows directory
                                                                                  PID:1444
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 34c -NGENProcess 35c -Pipe 354 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2168
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 36c -NGENProcess 330 -Pipe 338 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:1840
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 368 -Pipe 358 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1992
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 35c -Pipe 360 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2200
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 1a4 -NGENProcess 36c -Pipe 344 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:3016
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a4 -InterruptEvent 364 -NGENProcess 35c -Pipe 31c -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:1712
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 37c -NGENProcess 370 -Pipe 368 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:1444
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 36c -Pipe 378 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:800
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 380 -NGENProcess 37c -Pipe 35c -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2496
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 330 -NGENProcess 36c -Pipe 374 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2580
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 38c -NGENProcess 364 -Pipe 34c -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:584
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 37c -Pipe 388 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2512
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 36c -Pipe 1a4 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:1392
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 364 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:1368
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 37c -Pipe 380 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:1552
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 36c -Pipe 330 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2788
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 364 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2200
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 37c -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2060
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 36c -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2532
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 364 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:1644
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 37c -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1136
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 36c -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:1920
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 364 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:1844
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 37c -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1748
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 36c -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2468
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 364 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:1180
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 37c -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1680
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 36c -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:952
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 364 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:1164
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 37c -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:2904
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 36c -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:2320
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 36c -NGENProcess 3d4 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1504
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 3e4 -NGENProcess 37c -Pipe 3cc -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:520
                                                                                                                                                • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                  C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:1408
                                                                                                                                                • C:\Windows\ehome\ehsched.exe
                                                                                                                                                  C:\Windows\ehome\ehsched.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1148
                                                                                                                                                • C:\Windows\eHome\EhTray.exe
                                                                                                                                                  "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                  1⤵
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                  PID:2280
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2776
                                                                                                                                                • C:\Windows\ehome\ehRec.exe
                                                                                                                                                  C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:1272
                                                                                                                                                • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                  C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1064
                                                                                                                                                • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                  "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  PID:1540
                                                                                                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1768
                                                                                                                                                • C:\Windows\System32\msdtc.exe
                                                                                                                                                  C:\Windows\System32\msdtc.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:2244
                                                                                                                                                • C:\Windows\system32\dllhost.exe
                                                                                                                                                  C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:1740
                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2756
                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:2552
                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:3060
                                                                                                                                                • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                  C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2396
                                                                                                                                                • C:\Windows\system32\locator.exe
                                                                                                                                                  C:\Windows\system32\locator.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2416
                                                                                                                                                • C:\Windows\System32\snmptrap.exe
                                                                                                                                                  C:\Windows\System32\snmptrap.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2420
                                                                                                                                                • C:\Windows\System32\vds.exe
                                                                                                                                                  C:\Windows\System32\vds.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1620
                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:948
                                                                                                                                                • C:\Windows\system32\wbengine.exe
                                                                                                                                                  "C:\Windows\system32\wbengine.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:1912
                                                                                                                                                • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                  C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2360
                                                                                                                                                • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                  "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:836
                                                                                                                                                • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                  C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:2272
                                                                                                                                                  • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                    "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                    2⤵
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:108
                                                                                                                                                  • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                    "C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:2880
                                                                                                                                                  • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                    "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                    2⤵
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:2864

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                  Filesize

                                                                                                                                                  706KB

                                                                                                                                                  MD5

                                                                                                                                                  ccaaca48e0137edbebf52d8db5fb11a1

                                                                                                                                                  SHA1

                                                                                                                                                  1bfe2e213572d711313ed7371f9ca182b545a58a

                                                                                                                                                  SHA256

                                                                                                                                                  a1150e41b8bd8d1ec8e899663716e1b0f714df61e991633fcb788e08668abd35

                                                                                                                                                  SHA512

                                                                                                                                                  5524223f66674fe6bf64f00f9e92927ae9e4cb4221a1a010e1e65ed8707bb4f05dcf72a4b4158cd1a39c607361ca1179eace56ed95ca1a9d3c8f8884882e6e42

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                  Filesize

                                                                                                                                                  30.1MB

                                                                                                                                                  MD5

                                                                                                                                                  4867d347f6a41396def1a404f5570f8e

                                                                                                                                                  SHA1

                                                                                                                                                  77f28d258d8e11f0d933b46eb06f310c52a3d2aa

                                                                                                                                                  SHA256

                                                                                                                                                  0cfd3bb47a7e4c87817b62539beda1b83ae6d9024e3a2eac821e430571bc34fe

                                                                                                                                                  SHA512

                                                                                                                                                  e80d1b32be8c624ca0e714784ceeb5d52f078cc1c68e6a63e334f77e8cb35ce6360487462c5b8b9c2ca1a4ffe1ca69cdfd6389aecbbc5c728560090ba54342df

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                  Filesize

                                                                                                                                                  781KB

                                                                                                                                                  MD5

                                                                                                                                                  3a50e17c317eb81e8ad53522d4929638

                                                                                                                                                  SHA1

                                                                                                                                                  63e313dde1cd3662b7dd50f5ff9d1e0614eaa83a

                                                                                                                                                  SHA256

                                                                                                                                                  ea2b2b997270b8eccb20b234838c1c14821d1593be57b0593b22730def31b0cd

                                                                                                                                                  SHA512

                                                                                                                                                  e4dda80911ba5f5ebc8d15aa1185771b641c4b96e9fff9d371f3f251fab2452410f6cf69994483fc4ab79d9f676dc26ad80391bae281e8e6b2c4b66d55804f13

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                  Filesize

                                                                                                                                                  5.2MB

                                                                                                                                                  MD5

                                                                                                                                                  5a4199ab3a595ff0b9703dd8f7d4825d

                                                                                                                                                  SHA1

                                                                                                                                                  95d96aafa51ef8f16ce5c6875c3e138d371df847

                                                                                                                                                  SHA256

                                                                                                                                                  191aead927b7f92fc6c35956ba0d313ebcfe89595dca4b5e8bda2f9fcc81b09e

                                                                                                                                                  SHA512

                                                                                                                                                  4077f23fc609fefbaeece6516f8c03a3cc86c56750fab5c8d91cf43ada38054aa452a53ffd539d2b4813443d844185f721593b73801edd40202e889b406ea4c2

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  MD5

                                                                                                                                                  c9658159d5e0ee0d8f4af7d20d5f6a7b

                                                                                                                                                  SHA1

                                                                                                                                                  26c131af492abb5052ca557fb006c549b8f0982c

                                                                                                                                                  SHA256

                                                                                                                                                  c0cfa8c2e4d7827f89016d9bc608aebce822f628aa9f02950c735aa87daa1ce0

                                                                                                                                                  SHA512

                                                                                                                                                  08af518f5d380556842983e08344aafbe3e014ac528f9b4c8020b12de8606977a6a8aa223ce0191e8e5e6d00b0d7a512bbba88967e38d93855a423f6ffd16117

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                  MD5

                                                                                                                                                  6055cf892a89d7a80ac91f0125a0a6fa

                                                                                                                                                  SHA1

                                                                                                                                                  5af1dedba22b09023d03de76835bc4768bc83c6c

                                                                                                                                                  SHA256

                                                                                                                                                  c7ce31c965c402bd66d9dc2e42f0bcc29779308c94a2d0885da493349d464b99

                                                                                                                                                  SHA512

                                                                                                                                                  cc37c0078e792b93ac75d4dc4469dab3cfde4dfe9c64af8a4c0284b183f9ea9949baf11b3cef646e778af91ea9b7f4fe4d82a531098cac595ffbe335a841ed6c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                  Filesize

                                                                                                                                                  24B

                                                                                                                                                  MD5

                                                                                                                                                  b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                  SHA1

                                                                                                                                                  9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                  SHA256

                                                                                                                                                  7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                  SHA512

                                                                                                                                                  cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                  Filesize

                                                                                                                                                  872KB

                                                                                                                                                  MD5

                                                                                                                                                  d6b50c2b88f05d708d1690f976e82701

                                                                                                                                                  SHA1

                                                                                                                                                  0b9a288c29d3c66999078b506ddf2d2291e01a44

                                                                                                                                                  SHA256

                                                                                                                                                  a863b75fdb25814fca07130b77ff42dc6f00fe65411b59b85239454b578b3bbf

                                                                                                                                                  SHA512

                                                                                                                                                  1d751314b02a9a2e4ab9ccc5618dad2e80a820fd494cc913985a52167a38e7aa90e3804c6418f92cdfe409e06d16b1cba5a948829b421747e74b108ba4faad8c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  678KB

                                                                                                                                                  MD5

                                                                                                                                                  4f6df23cbe8c9447d213ac0fc8f873c3

                                                                                                                                                  SHA1

                                                                                                                                                  14b691588556dc85911d30bff6e09ce68c275de9

                                                                                                                                                  SHA256

                                                                                                                                                  1d75d35a1c65e532ffd5bcf158fbb22e8fea1d251270bb556fcf1240ef4b1349

                                                                                                                                                  SHA512

                                                                                                                                                  c19d5c1f443d21aabc723859672fe4ab315fe4c8bb9d0bf4cb0435f9844c188d25d74564937e7a6a45b217158fd319f1086dc4467cb2cfacc6d3e412b9bc0a7a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  6cc8a969516d030f6a756d1ad44ad97c

                                                                                                                                                  SHA1

                                                                                                                                                  0c4f7bc54a4ae4c36a4f9132e6cd8fd8cb605820

                                                                                                                                                  SHA256

                                                                                                                                                  9b4911826d79be724e3daf314617b3c3de3ed311d5d80ed3ff6a8b2abee1a9c7

                                                                                                                                                  SHA512

                                                                                                                                                  91e106c2bc1b98364443168861f4ddf53c845f3a2c22f64e2c11156a38072b43edfb62e3a228b0746fbc776dfe617aac2ff31b4b5360c191017e2e04c162a439

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  625KB

                                                                                                                                                  MD5

                                                                                                                                                  8e0e73c05a1793aa2a43d5212737b3c6

                                                                                                                                                  SHA1

                                                                                                                                                  26f157a4695f2488f8f532e751f500d1fe5ae495

                                                                                                                                                  SHA256

                                                                                                                                                  b8046205b7db85800b35ba2cbf238333d621d45d072879519c1bbb0445ed6cbc

                                                                                                                                                  SHA512

                                                                                                                                                  3e7207093b2113bf4c9f9f4df9593e333e57cc4e5a16497aa36109e4b1788e3ec226cb7ee1dab683429c08dc541d26edc470908f266423aa6a43c4348e9a759a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                  Filesize

                                                                                                                                                  1003KB

                                                                                                                                                  MD5

                                                                                                                                                  f3b5518e6c7eebfdce9a2746668fcf3c

                                                                                                                                                  SHA1

                                                                                                                                                  7fab8adbf2eb08a92cd08e9cabbe15b7e1c0b5cc

                                                                                                                                                  SHA256

                                                                                                                                                  6a8b9dde9ba6d2aee99a6e498db469c6fbabc59c73e91790a3e3763bfa6a2765

                                                                                                                                                  SHA512

                                                                                                                                                  dbe0b1bad1a95a3d4728b037aa0627256d8638cee0d8ad6c4df48f091ad2b0d160ca3965d408aec3fbdb0f4a2489036df3cd3cee8d207c4e181f248c33bb80dc

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  656KB

                                                                                                                                                  MD5

                                                                                                                                                  6591a2bb6840d378899010a068b73ec1

                                                                                                                                                  SHA1

                                                                                                                                                  3aef7b3f88b27c8de273c39a0181a2fc9e157162

                                                                                                                                                  SHA256

                                                                                                                                                  a828637e825fd1d35a55b27badd4218c704bed0d5e88e2f3a3e8cdb3dcfa34ab

                                                                                                                                                  SHA512

                                                                                                                                                  ccfa5db7dd389834f5c5f6d1183f2c231dfe4dfe40bfa6820a2fa28d02ceb6691eb5e6ef1a7ca2a76ba2bbd370435e7d6f9af3b1429b5d016d62c79548d68de8

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                  Filesize

                                                                                                                                                  587KB

                                                                                                                                                  MD5

                                                                                                                                                  404b152025e7898ca654426348509171

                                                                                                                                                  SHA1

                                                                                                                                                  8899bf986d3005ac53f3a18275a51367bc324ded

                                                                                                                                                  SHA256

                                                                                                                                                  d879692d67ee6b859bf8334a562ead12d097816a70f0777ae4ee5020d67603e8

                                                                                                                                                  SHA512

                                                                                                                                                  59728c216ae0f44cacf9ec596b07c9b8bd3a59987a86e63d4dae86ce9675728629cf2627677b8a87f81257c895f1ca9ff216263668826498801d748f31f03ba5

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Temp\Cab89B9.tmp
                                                                                                                                                  Filesize

                                                                                                                                                  29KB

                                                                                                                                                  MD5

                                                                                                                                                  d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                                  SHA1

                                                                                                                                                  e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                                  SHA256

                                                                                                                                                  a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                                  SHA512

                                                                                                                                                  17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\Temp\Tar8B8F.tmp
                                                                                                                                                  Filesize

                                                                                                                                                  81KB

                                                                                                                                                  MD5

                                                                                                                                                  b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                                  SHA1

                                                                                                                                                  7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                                  SHA256

                                                                                                                                                  725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                                  SHA512

                                                                                                                                                  f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  105KB

                                                                                                                                                  MD5

                                                                                                                                                  d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                  SHA1

                                                                                                                                                  9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                  SHA256

                                                                                                                                                  dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                  SHA512

                                                                                                                                                  5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  248KB

                                                                                                                                                  MD5

                                                                                                                                                  4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                  SHA1

                                                                                                                                                  f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                  SHA256

                                                                                                                                                  c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                  SHA512

                                                                                                                                                  c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  1.0MB

                                                                                                                                                  MD5

                                                                                                                                                  598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                                  SHA1

                                                                                                                                                  5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                                  SHA256

                                                                                                                                                  e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                                  SHA512

                                                                                                                                                  774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\01c05fb82e098dfa7fbe22709a62e545\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  305KB

                                                                                                                                                  MD5

                                                                                                                                                  78bb995b60c44a1a580df435d744be32

                                                                                                                                                  SHA1

                                                                                                                                                  ce5dbc1914ba3d6125b666dff00d1343f41f26ac

                                                                                                                                                  SHA256

                                                                                                                                                  dccc2a569bedabe7ecaadb9197a306fc9027ed9da8c6429bf8791727092cb57b

                                                                                                                                                  SHA512

                                                                                                                                                  e85d5dcf14838a351c24e9e4fe8747818e70491b19b2bfc736493389124682be8732bb35986595654c3ac399fec8aed8c249e0262d98c9705138e2d8ee66c1bf

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  58KB

                                                                                                                                                  MD5

                                                                                                                                                  3d6987fc36386537669f2450761cdd9d

                                                                                                                                                  SHA1

                                                                                                                                                  7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                  SHA256

                                                                                                                                                  34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                  SHA512

                                                                                                                                                  1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  205KB

                                                                                                                                                  MD5

                                                                                                                                                  0a41e63195a60814fe770be368b4992f

                                                                                                                                                  SHA1

                                                                                                                                                  d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                  SHA256

                                                                                                                                                  4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                  SHA512

                                                                                                                                                  1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0e813d6bf3d10e7844ba5f253443fb1d\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  271KB

                                                                                                                                                  MD5

                                                                                                                                                  18e5bcc5e7e0de48de8adf5e75898fd9

                                                                                                                                                  SHA1

                                                                                                                                                  c75a67899351dfd07719947ec8e0108625505858

                                                                                                                                                  SHA256

                                                                                                                                                  eb2d1775daed79315fafbcb7fde4e793f3d9949fd0142c02837f4f3cf3376cf8

                                                                                                                                                  SHA512

                                                                                                                                                  b10bc2174f5deb5e035ad40c278cfd91c4bd98b8add4b221bdd60031115a580ce4b4e685586ac1d59a6071d263af8896abae520cec4ea8e19377509a7bcd7e39

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  68c51bcdc03e97a119431061273f045a

                                                                                                                                                  SHA1

                                                                                                                                                  6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                  SHA256

                                                                                                                                                  4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                  SHA512

                                                                                                                                                  d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  198KB

                                                                                                                                                  MD5

                                                                                                                                                  9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                  SHA1

                                                                                                                                                  ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                  SHA256

                                                                                                                                                  469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                  SHA512

                                                                                                                                                  58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\497e2f430fba56b4578032a8877b5367\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  221KB

                                                                                                                                                  MD5

                                                                                                                                                  d708f5747c19c0c92b6ca9f6201ef99d

                                                                                                                                                  SHA1

                                                                                                                                                  84ca6a858a00a47da3d64deded1128a2f2a7fc78

                                                                                                                                                  SHA256

                                                                                                                                                  44600fe132698f14fddb086c57926c4e46e82511102efab231ee68b84ce36c84

                                                                                                                                                  SHA512

                                                                                                                                                  eb422695c0bda0c64c845c2d55498dfb72031c18be258ff8e3cdf3c2a4875c150c68451ab29c645d0636849d5f6effcc6653c94a429064499d53952547634923

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  70KB

                                                                                                                                                  MD5

                                                                                                                                                  57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                  SHA1

                                                                                                                                                  da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                  SHA256

                                                                                                                                                  1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                  SHA512

                                                                                                                                                  1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  87KB

                                                                                                                                                  MD5

                                                                                                                                                  ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                  SHA1

                                                                                                                                                  4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                  SHA256

                                                                                                                                                  b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                  SHA512

                                                                                                                                                  d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  82KB

                                                                                                                                                  MD5

                                                                                                                                                  2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                  SHA1

                                                                                                                                                  66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                  SHA256

                                                                                                                                                  37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                  SHA512

                                                                                                                                                  cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  85KB

                                                                                                                                                  MD5

                                                                                                                                                  5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                  SHA1

                                                                                                                                                  dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                  SHA256

                                                                                                                                                  d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                  SHA512

                                                                                                                                                  27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bedb76f6c88d82172de338a020bcc62e\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  122KB

                                                                                                                                                  MD5

                                                                                                                                                  3d41d6cd82e344de8bccd60a677f33df

                                                                                                                                                  SHA1

                                                                                                                                                  777427d3738c52148705de46c648ded38707caa3

                                                                                                                                                  SHA256

                                                                                                                                                  1f3c2491dc147db676e165b2d010d6a9c796ea8287b2359fcf40870d94058bc8

                                                                                                                                                  SHA512

                                                                                                                                                  d7810c01bc2e72e507b79fe1c47abe447d2bb26a1b0e1f8c761f80d7f56e13e61f150992658a5b4b5c4d3d1a871756d2436696d81c283567b4cd8e5fa6292dba

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  298KB

                                                                                                                                                  MD5

                                                                                                                                                  5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                  SHA1

                                                                                                                                                  1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                  SHA256

                                                                                                                                                  5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                  SHA512

                                                                                                                                                  58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE86C.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll
                                                                                                                                                  Filesize

                                                                                                                                                  58KB

                                                                                                                                                  MD5

                                                                                                                                                  a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                  SHA1

                                                                                                                                                  500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                  SHA256

                                                                                                                                                  1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                  SHA512

                                                                                                                                                  b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF5E3.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                  SHA1

                                                                                                                                                  d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                  SHA256

                                                                                                                                                  f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                  SHA512

                                                                                                                                                  8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  124KB

                                                                                                                                                  MD5

                                                                                                                                                  929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                  SHA1

                                                                                                                                                  993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                  SHA256

                                                                                                                                                  2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                  SHA512

                                                                                                                                                  effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  MD5

                                                                                                                                                  10b5a285eafccdd35390bb49861657e7

                                                                                                                                                  SHA1

                                                                                                                                                  62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                  SHA256

                                                                                                                                                  5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                  SHA512

                                                                                                                                                  19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                                  Filesize

                                                                                                                                                  88KB

                                                                                                                                                  MD5

                                                                                                                                                  1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                  SHA1

                                                                                                                                                  4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                  SHA256

                                                                                                                                                  9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                  SHA512

                                                                                                                                                  e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\ehome\ehsched.exe
                                                                                                                                                  Filesize

                                                                                                                                                  691KB

                                                                                                                                                  MD5

                                                                                                                                                  459cfd981bc595b122800bd329f3a2aa

                                                                                                                                                  SHA1

                                                                                                                                                  78066f5acdf1c30127ec7a00f012ab05510514cc

                                                                                                                                                  SHA256

                                                                                                                                                  0e362142ac065ba205b35107059e11b439d1128c27b5b3f81c830f31de5ce923

                                                                                                                                                  SHA512

                                                                                                                                                  74e9f49a3e67bd1187727754241a36d4084495e13e5e53f56b25cc37d177387e62d10531ad25081807708cea2fad484978757b780798200a1fd7737e9d8cca7c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\system32\fxssvc.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  314ca819398f05205c8725bf3c303c07

                                                                                                                                                  SHA1

                                                                                                                                                  50ad017e90fef8509bbaf730b0e3a274ac40b9c9

                                                                                                                                                  SHA256

                                                                                                                                                  17db6510a55eb237513aadf471b727b33f215c13d16a067ce78e399ecfed0fb4

                                                                                                                                                  SHA512

                                                                                                                                                  1ff109bec93f268d9eb016b43f8c94f64f4ff505d18aa2beda0576e7836d02d1c14e4baa63175e6e55275a697a8660e967ca36f1076e8c627cb86159f511594a

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                  Filesize

                                                                                                                                                  648KB

                                                                                                                                                  MD5

                                                                                                                                                  34205b13784dbe19977c6ca5ff467a40

                                                                                                                                                  SHA1

                                                                                                                                                  08740462577f0ee4a138f4ced4a10526b5b94901

                                                                                                                                                  SHA256

                                                                                                                                                  2fe4789459555b0e2e9426f7a8a710d4cd6d7eef545dff0f1bea6c233f873915

                                                                                                                                                  SHA512

                                                                                                                                                  bdc93058ae079b5cd0adfa11fecffb88bc8887bac2fe8dd0a2b89c59656176585f57b00c259a0011b20815075efbee2bf90cd6081acee3961682594c256d699f

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                  Filesize

                                                                                                                                                  603KB

                                                                                                                                                  MD5

                                                                                                                                                  c907e3e869fb51e641bb3213dd56fc73

                                                                                                                                                  SHA1

                                                                                                                                                  0215ee8c441938e0f04eb74025337d65a399b236

                                                                                                                                                  SHA256

                                                                                                                                                  6aa16d25cc19c407ab9f4709e6c078262f69e476c011c47d89a4e7cfa3e57142

                                                                                                                                                  SHA512

                                                                                                                                                  2e3341ab4f878f568dae192f2ecde0dc086032f494dcc945ede9d68485e8cc0bc3484ef7f1034d83fba869485e773ec99566f0b9490ef85e7dcde250436b6b49

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\Locator.exe
                                                                                                                                                  Filesize

                                                                                                                                                  577KB

                                                                                                                                                  MD5

                                                                                                                                                  1f4a8fdd8d66036f155eaad245dbdfac

                                                                                                                                                  SHA1

                                                                                                                                                  aaf8d74a96fb2973c294e703ec868a583bd0a3cf

                                                                                                                                                  SHA256

                                                                                                                                                  f00f9a9078c281da6154cb11b1fe42ae6100a69f3081e7621e00bf9899691794

                                                                                                                                                  SHA512

                                                                                                                                                  fd6f7db3d093f17addcf9590002cdbbf53cbe961f735c379fcb88d7ab48e7b17a1485c84a98dabba5a807e71fbaf816f85c4927fb370f5a9a83e617d615e437f

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\alg.exe
                                                                                                                                                  Filesize

                                                                                                                                                  644KB

                                                                                                                                                  MD5

                                                                                                                                                  98369f34c8bc00dc50238de70a174af9

                                                                                                                                                  SHA1

                                                                                                                                                  9688b2513efae75e3570edc31c934b6073654481

                                                                                                                                                  SHA256

                                                                                                                                                  955d2804c579dce59b581cece7d4eda599145722f21c42fb0ba6506d5c1f5333

                                                                                                                                                  SHA512

                                                                                                                                                  f01a99b4fadc9df06d9dd06b60955c1519acbe9cd5ec35336e4cf251d7849523b4a9d39996e379900ec74572b9671bf26720f5ea650318290202d89e54aab88f

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\dllhost.exe
                                                                                                                                                  Filesize

                                                                                                                                                  577KB

                                                                                                                                                  MD5

                                                                                                                                                  04084fb190d6f8a3dcd61cba1901678a

                                                                                                                                                  SHA1

                                                                                                                                                  4c73cf61a366334d9b49741507fffedadc9a4445

                                                                                                                                                  SHA256

                                                                                                                                                  25993a9dbe79ea316025a21b69fc471eba833ec9b4ff81a7afa5f20ae443ab37

                                                                                                                                                  SHA512

                                                                                                                                                  b38e89e86747a3d2e4c8128a13b3df6461902637db26b2a5644df72eb6e372a828e84723c73ddd054c1b5cc031fe17504f02ba121d1514175ccb477d0b013de1

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\ieetwcollector.exe
                                                                                                                                                  Filesize

                                                                                                                                                  674KB

                                                                                                                                                  MD5

                                                                                                                                                  577ca95a008dff4d1fe87964c6bb5746

                                                                                                                                                  SHA1

                                                                                                                                                  641da3a3bf35a998c46e0f32077c0d7e503fb826

                                                                                                                                                  SHA256

                                                                                                                                                  f45715542fe6fa212440c0fea32becd1e3a0c3e08a44aa71c319b343faf8d945

                                                                                                                                                  SHA512

                                                                                                                                                  eed3461089adbb9accb72376e6e56caf876879d19904e15eb679361f14a24dda157a0b9999d7f63bafb5ed3d9cfbf51f232176fbe857ddd1a24b45e1e3710fb0

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\msdtc.exe
                                                                                                                                                  Filesize

                                                                                                                                                  705KB

                                                                                                                                                  MD5

                                                                                                                                                  26055336e2c1b06075bedd8cc9820391

                                                                                                                                                  SHA1

                                                                                                                                                  649c69ec1bd737a858802993ee3573825b162d26

                                                                                                                                                  SHA256

                                                                                                                                                  ff4ca8592a10fbd6a21ff7d3b2c8dfaa69dd6df22f6db744a7fe6a000e4e71a9

                                                                                                                                                  SHA512

                                                                                                                                                  25c7a5d135b89f63948d2a2e150d3dddeb9fd65d058835fa9953b916ed6a99fa11bfbf798ee7285d3bd0388d22844589626d0d7c61530ead32c46fe239022537

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\System32\msiexec.exe
                                                                                                                                                  Filesize

                                                                                                                                                  691KB

                                                                                                                                                  MD5

                                                                                                                                                  46ee61cec37bb55a412c590a5e19593f

                                                                                                                                                  SHA1

                                                                                                                                                  5d8d5f57d9137ffe908fbd2c970e5abf608c08ca

                                                                                                                                                  SHA256

                                                                                                                                                  b12dbd2ca50186231fca4fbceaf601b5f15d7ca302f12946f35216e9f9e585c1

                                                                                                                                                  SHA512

                                                                                                                                                  15e14fbfd64fb736b51f5ff60b942e7a794295559ec19c94643ec5498f96294304d01f5d09c81c292724d4765af10bdf7b67c33ee132914971de4031e2164346

                                                                                                                                                  Download Submit

                                                                                                                                                • \Windows\ehome\ehrecvr.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  997839440bf18a2d1158d4221d9226af

                                                                                                                                                  SHA1

                                                                                                                                                  abc9203a2b8c716cdab492fddddf0172922ac70a

                                                                                                                                                  SHA256

                                                                                                                                                  d0b7b2c034e7d97e2d58be7d07ea01c9dd45326343afe3877ed1bc63d215683f

                                                                                                                                                  SHA512

                                                                                                                                                  edbd165a15f92dedf2a1b7713a44d054f6ba73dd69dcc23029767f424b106f7748b99502ae718d53f1a500a97a114a5ce93209f45061179645384fe67ec9bc3d

                                                                                                                                                  Download Submit

                                                                                                                                                • memory/560-686-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/560-699-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/580-73-0x0000000000AB0000-0x0000000000B17000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/580-78-0x0000000000AB0000-0x0000000000B17000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/580-72-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/580-227-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/836-828-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/840-89-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/840-95-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/840-88-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/840-240-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/924-480-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/924-463-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/948-796-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1064-723-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1064-160-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1064-400-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1076-445-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1076-464-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1148-310-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  712KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1148-125-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  712KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1148-720-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  712KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1200-54-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  668KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1200-109-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  668KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1200-63-0x0000000000420000-0x0000000000480000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1200-55-0x0000000000420000-0x0000000000480000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1364-696-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1364-710-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1408-114-0x0000000000860000-0x00000000008C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1408-113-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1408-728-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1408-292-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1464-637-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1540-398-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  30.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1540-178-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  30.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1620-778-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1632-403-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1632-419-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1668-593-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1724-376-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1724-404-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1728-687-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1740-488-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  596KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1740-205-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  596KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1768-202-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  808KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1768-182-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  808KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1788-616-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1848-566-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1848-579-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1872-350-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1872-312-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1912-806-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  Download

                                                                                                                                                • memory/1920-320-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1920-294-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  696KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2036-568-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2036-548-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2120-589-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2120-604-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2136-715-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2168-535-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2168-528-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2240-543-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2240-547-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2244-191-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  728KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2244-461-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  728KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2360-816-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  784KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2396-748-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  600KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2416-758-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  596KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2420-768-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  600KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2524-663-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2540-99-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  636KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2540-46-0x0000000000990000-0x00000000009F7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2540-41-0x0000000000990000-0x00000000009F7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  412KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2540-40-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  636KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2552-241-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  5.3MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2552-527-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  5.3MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2560-667-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2560-660-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2684-414-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2684-437-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2696-147-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  628KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2696-28-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  628KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2696-29-0x0000000000930000-0x0000000000990000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2696-37-0x0000000000930000-0x0000000000990000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2748-510-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2748-531-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2756-228-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  724KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2776-375-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2776-148-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.2MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2800-643-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2800-640-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2824-489-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2824-511-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2956-22-0x00000000008E0000-0x0000000000940000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2956-21-0x00000000008E0000-0x0000000000940000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2956-112-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  656KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2956-16-0x00000000008E0000-0x0000000000940000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2956-14-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  656KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2960-628-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2960-615-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  672KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2960-617-0x0000000003C20000-0x0000000003CDA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  744KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2980-190-0x0000000000670000-0x00000000006D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2980-0-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  668KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2980-71-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  668KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2980-189-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  668KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2980-9-0x0000000000670000-0x00000000006D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2980-1-0x0000000000670000-0x00000000006D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3060-736-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  712KB

                                                                                                                                                  Download