Overview

overview

7

Static

static

3

2024-06-20...re.exe

windows7-x64

7

2024-06-20...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 16:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-20_5c92a8dfcffb2c4effe07a9a5ab3fcd2_bkransomware.exe

  • Size

    1.8MB

  • MD5

    5c92a8dfcffb2c4effe07a9a5ab3fcd2

  • SHA1

    346174df758cafdbbafc9338aab44a3891d4a94e

  • SHA256

    c84a3f16b4a1cf7f8294d29a1aa966206903de7533bfc150db437266ed892189

  • SHA512

    66888615c4c68c479fbb212b1f3748eebfe3c1c4618e7eae19dcd37abe4042e34d6a2ce6bf9614616b290f0fe60ddcbb2bca6c0e15c154e43cc871debdf61f7b

  • SSDEEP

    49152:lEy9+ApwXk1QE1RzsEQPaxHNGxlMPdlR8v4UC0Eg6ET7M/I:993wXmoK6l2/V0cETQ/I

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 57 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-20_5c92a8dfcffb2c4effe07a9a5ab3fcd2_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-20_5c92a8dfcffb2c4effe07a9a5ab3fcd2_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2200
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2612
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2856
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2588
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2544
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2004
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2956
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 24c -NGENProcess 254 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1144
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1f0 -NGENProcess 244 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2392
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 25c -NGENProcess 268 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:928
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1d4 -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 244 -NGENProcess 270 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1396
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 258 -NGENProcess 26c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 254 -NGENProcess 250 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1860
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 244 -NGENProcess 27c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 280 -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 270 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1792
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 254 -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2148
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 268 -NGENProcess 284 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 270 -NGENProcess 290 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1860
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 278 -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2360
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 294 -NGENProcess 244 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:776
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 1d4 -NGENProcess 288 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1172
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 1d4 -NGENProcess 294 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1436
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 268 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:856
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 2a8 -NGENProcess 278 -Pipe 2a4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2a8 -NGENProcess 268 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:664
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:664
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1560
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 204 -NGENProcess 1b0 -Pipe 200 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2036
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 258 -NGENProcess 1c4 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1644
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 230 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1940
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 1b0 -Pipe 22c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2976
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 1c4 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1904
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1b0 -NGENProcess 1c4 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1872
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 270 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1980
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 264 -Pipe 208 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2056
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 278 -NGENProcess 1c4 -Pipe 230 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1780
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1c4 -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:884
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 280 -NGENProcess 264 -Pipe 1b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1604
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 264 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2648
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 288 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:336
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 270 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
        PID:1636
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 290 -NGENProcess 278 -Pipe 1c4 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2308
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 278 -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"
        2⤵
          PID:2736
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 25c -NGENProcess 298 -Pipe 280 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1764
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 298 -NGENProcess 264 -Pipe 294 -Comment "NGen Worker Process"
          2⤵
            PID:2388
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 270 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2244
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 288 -NGENProcess 25c -Pipe 29c -Comment "NGen Worker Process"
            2⤵
              PID:2056
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a8 -NGENProcess 264 -Pipe 278 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2984
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 264 -NGENProcess 2a0 -Pipe 2a4 -Comment "NGen Worker Process"
              2⤵
                PID:1540
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2b0 -NGENProcess 25c -Pipe 298 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2400
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 25c -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
                2⤵
                  PID:2444
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 290 -NGENProcess 2a0 -Pipe 25c -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2456
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 264 -Comment "NGen Worker Process"
                  2⤵
                    PID:1860
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 2b4 -Pipe 2b0 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:1052
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2b4 -NGENProcess 290 -Pipe 24c -Comment "NGen Worker Process"
                    2⤵
                      PID:2496
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2c8 -NGENProcess 288 -Pipe 2a8 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2716
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 288 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
                      2⤵
                        PID:1396
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2d0 -NGENProcess 290 -Pipe 2a0 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:620
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 290 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
                        2⤵
                          PID:1736
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 2b4 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2372
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
                          2⤵
                            PID:2008
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 2c8 -Pipe 288 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2020
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:2144
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 290 -Comment "NGen Worker Process"
                            2⤵
                              PID:2092
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2e4 -Pipe 2bc -Comment "NGen Worker Process"
                              2⤵
                                PID:2728
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2c0 -Comment "NGen Worker Process"
                                2⤵
                                  PID:3016
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1496
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2e4 -Pipe 2e0 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2584
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e4 -NGENProcess 2f0 -Pipe 2d8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2588
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2f0 -NGENProcess 2c8 -Pipe 2d0 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1888
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 304 -NGENProcess 2fc -Pipe 2ec -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:1664
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 300 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1972
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 30c -NGENProcess 2c8 -Pipe 2f8 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2552
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 308 -Pipe 2e8 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1228
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2e4 -Pipe 2f0 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1312
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2c8 -Pipe 2f4 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2584
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 308 -Pipe 304 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2920
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2e4 -Pipe 2fc -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:2208
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2c8 -Pipe 30c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2976
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 308 -Pipe 310 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:920
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2e4 -Pipe 314 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2080
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2c8 -Pipe 318 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2712
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1580
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2e4 -Pipe 320 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:916
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2c8 -Pipe 324 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:1980
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 308 -Pipe 328 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1152
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2e4 -Pipe 32c -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2728
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2c8 -Pipe 330 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2456
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 308 -Pipe 334 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:2648
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2e4 -Pipe 338 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2180
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 1fc -NGENProcess 348 -Pipe 2c8 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:3044
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 204 -NGENProcess 350 -Pipe 344 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2760
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 340 -NGENProcess 33c -Pipe 2e4 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:2460
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 358 -NGENProcess 348 -Pipe 1f4 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:1724
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 350 -Pipe 354 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:1364
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 350 -NGENProcess 340 -Pipe 33c -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2456
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 364 -NGENProcess 348 -Pipe 1fc -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2488
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 360 -Pipe 204 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:584
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 340 -Pipe 358 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:916
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 348 -Pipe 34c -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2236
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 360 -Pipe 35c -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:536
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 340 -Pipe 350 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2008
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 348 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2892
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 374 -NGENProcess 380 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1496
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 36c -NGENProcess 348 -Pipe 308 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:1128
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 384 -NGENProcess 37c -Pipe 340 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:2508
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 380 -Pipe 238 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:1136
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 348 -Pipe 360 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2244
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 37c -Pipe 368 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:1516
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 380 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:1724
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 348 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:1780
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 37c -Pipe 384 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:604
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 380 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2884
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 348 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2148
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 37c -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2144
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 380 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1872
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 348 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2340
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 37c -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:944
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 380 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:852
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 348 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2712
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 37c -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:1668
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 380 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1604
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 348 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2584
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 37c -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2040
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 380 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1664
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 348 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1724
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 348 -NGENProcess 3cc -Pipe 37c -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:2836
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 3dc -NGENProcess 380 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:584
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 380 -NGENProcess 3d4 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:1116
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 3e4 -NGENProcess 3cc -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2056
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3cc -NGENProcess 3dc -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1532
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3ec -NGENProcess 3d4 -Pipe 348 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2876
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 3e8 -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:872
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3e8 -NGENProcess 3cc -Pipe 3dc -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1956
                                                                                                                                                      • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                        C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        PID:1688
                                                                                                                                                      • C:\Windows\ehome\ehsched.exe
                                                                                                                                                        C:\Windows\ehome\ehsched.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1244
                                                                                                                                                      • C:\Windows\eHome\EhTray.exe
                                                                                                                                                        "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                        1⤵
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                        PID:1148
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1488
                                                                                                                                                      • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                        C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2340
                                                                                                                                                      • C:\Windows\ehome\ehRec.exe
                                                                                                                                                        C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:3036
                                                                                                                                                      • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                        "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:1236
                                                                                                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:280
                                                                                                                                                      • C:\Windows\System32\msdtc.exe
                                                                                                                                                        C:\Windows\System32\msdtc.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:892
                                                                                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:544
                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1968
                                                                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:3068
                                                                                                                                                      • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                        C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:556
                                                                                                                                                      • C:\Windows\system32\locator.exe
                                                                                                                                                        C:\Windows\system32\locator.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2936
                                                                                                                                                      • C:\Windows\System32\snmptrap.exe
                                                                                                                                                        C:\Windows\System32\snmptrap.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2960
                                                                                                                                                      • C:\Windows\System32\vds.exe
                                                                                                                                                        C:\Windows\System32\vds.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1072
                                                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:1164
                                                                                                                                                      • C:\Windows\system32\wbengine.exe
                                                                                                                                                        "C:\Windows\system32\wbengine.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:2060
                                                                                                                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2900
                                                                                                                                                      • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                        "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:2832
                                                                                                                                                      • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                        C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:1108
                                                                                                                                                        • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                          2⤵
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2204
                                                                                                                                                        • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                          "C:\Windows\system32\SearchFilterHost.exe" 0 596 600 608 65536 604
                                                                                                                                                          2⤵
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:2672
                                                                                                                                                        • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:1920
                                                                                                                                                      • C:\Windows\system32\dllhost.exe
                                                                                                                                                        C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:752

                                                                                                                                                      Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              84854a1a1014f85ef5e64f6918c3e990

                                                                                                                                                              SHA1

                                                                                                                                                              cd1a12f0e8affdf64e9b9324a6fee1e1cec98a14

                                                                                                                                                              SHA256

                                                                                                                                                              2d5a63d603027ab99be1cb6871aaa705112734a4b606b02d237743cafb50e4df

                                                                                                                                                              SHA512

                                                                                                                                                              6ec758e3facbc5da36ce91904346a2fc2ac8464c601a526cc4af9a9ec77b932c5eb7bf2a3b724d60d42e7a96cb819321b2a838da121a6ece3e48565b19a37e7f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                              Filesize

                                                                                                                                                              30.1MB

                                                                                                                                                              MD5

                                                                                                                                                              321c2f9c03f60e11b48e4749c2e8aa27

                                                                                                                                                              SHA1

                                                                                                                                                              0072cb71d199375d0a90a868ad812e6594cc76b2

                                                                                                                                                              SHA256

                                                                                                                                                              6a2598c9e0dd3aaeb6519281e0e7480b8308ce36eeb82930721ee8b73b5c8319

                                                                                                                                                              SHA512

                                                                                                                                                              235bcd5ad28c9ed66e4a2f98059af78d1ee8acd1c4c520c7afe26ff63d5743224a47f3509a6c5a21604264a20db4e6d887e0b7e641c214845bfc6620f09f8ec6

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              MD5

                                                                                                                                                              8c3c168dfd4e39bbeedecfbed644b2e8

                                                                                                                                                              SHA1

                                                                                                                                                              75fcc09e80cd874143b1b2f631680c5eadb0751b

                                                                                                                                                              SHA256

                                                                                                                                                              a59d976182f2534355626f34393d7632f3adc248e78c4c77e767f90df2fede03

                                                                                                                                                              SHA512

                                                                                                                                                              78f3a8ee5fed628d8b776973870ace8ffe24af86bfd2c175dde8e18924dc2fe52ff98befcf5c8fb5c2dc40658780191cb69fba59247373ee8de5ee834394552b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                                              Filesize

                                                                                                                                                              5.2MB

                                                                                                                                                              MD5

                                                                                                                                                              b7fb80023f0b6986ebb1921262b43697

                                                                                                                                                              SHA1

                                                                                                                                                              1bc036c8c896ccfee3499d0ec3f1c7627cf3b07b

                                                                                                                                                              SHA256

                                                                                                                                                              5eb0210fc52cc1537f2f0e6c42814d31324b0d964f8fdd4a157294816f15e1f7

                                                                                                                                                              SHA512

                                                                                                                                                              66b96d8368341989783f94bba81fb9da26517a5455fc74724928a752dc3a5c417f17ec050ccbaf2626c259c32ab55f17b3dc0f4474144a2e11bfda20d8f6c399

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              MD5

                                                                                                                                                              3a74466dbf35e87830a1abd993fc91c1

                                                                                                                                                              SHA1

                                                                                                                                                              e375cd9a69317a24f9c3c524085deab1c86a0600

                                                                                                                                                              SHA256

                                                                                                                                                              3c48134f525f2d5efa5800a331004c4e842b64f11155ffff016211a5985530c3

                                                                                                                                                              SHA512

                                                                                                                                                              3bcb0235f8a5849559b7574c70390ab04866a87b9da7ae073ae4e321835fb044691080d407912b3f21f0666077b3b04e9d2fd387dbe95d7a6e23314b1f7b3176

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              MD5

                                                                                                                                                              e32f6d8781d434cc3f5fd5e1faea292d

                                                                                                                                                              SHA1

                                                                                                                                                              4f442f981abf4b25b823e8210135a026880ca1ae

                                                                                                                                                              SHA256

                                                                                                                                                              1e0eac2a26831b14e7f470b8589c392a79cbe5b9804270ffcb0637cf51554ac1

                                                                                                                                                              SHA512

                                                                                                                                                              075c55f977e505111d346370a2ba21c6dbbd08e1ed849dbae50067d9d08c355408d449f0ae21a60a59303bebbdcf66c68c147064b8b24c22d42481580af8eb21

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                              Filesize

                                                                                                                                                              1024KB

                                                                                                                                                              MD5

                                                                                                                                                              6055cf892a89d7a80ac91f0125a0a6fa

                                                                                                                                                              SHA1

                                                                                                                                                              5af1dedba22b09023d03de76835bc4768bc83c6c

                                                                                                                                                              SHA256

                                                                                                                                                              c7ce31c965c402bd66d9dc2e42f0bcc29779308c94a2d0885da493349d464b99

                                                                                                                                                              SHA512

                                                                                                                                                              cc37c0078e792b93ac75d4dc4469dab3cfde4dfe9c64af8a4c0284b183f9ea9949baf11b3cef646e778af91ea9b7f4fe4d82a531098cac595ffbe335a841ed6c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                              Filesize

                                                                                                                                                              24B

                                                                                                                                                              MD5

                                                                                                                                                              b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                              SHA1

                                                                                                                                                              9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                              SHA256

                                                                                                                                                              7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                              SHA512

                                                                                                                                                              cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                              Filesize

                                                                                                                                                              872KB

                                                                                                                                                              MD5

                                                                                                                                                              2a7a7203fa368ea458c2f27a1a0d8d17

                                                                                                                                                              SHA1

                                                                                                                                                              cb13dd0715c539e25cb8cba2ac91f80f00b18fae

                                                                                                                                                              SHA256

                                                                                                                                                              46542a8926b11cdbd31d3ad169669c90d2fd2d1adb44efffdf93980252a710bc

                                                                                                                                                              SHA512

                                                                                                                                                              487faeeec1c7af3b336a3ad752318da08e926e481a2aef2b4a5f337e592567c5ae4ef96068c05d5822f04cb618bc6ff47e8c8888f902b6a0212a806f8b9f583a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              ed2e0bb71b5d2d0dcbe0d2eebfcfa698

                                                                                                                                                              SHA1

                                                                                                                                                              57b3eaa92a806445dcb365dd75a9f1e29c794fe4

                                                                                                                                                              SHA256

                                                                                                                                                              06a4f375c600b0356c487f1e54a211642126a85dd851347c32ef31feb9abf768

                                                                                                                                                              SHA512

                                                                                                                                                              5fc3c9f2e0239862f2eeeec7a81c2768b52773516473f51d358d7dde8f9eb5def4cab94baf1360d33bd601bf65493e1e56726f20f05e5fa70a7690156a5b7bd8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              MD5

                                                                                                                                                              b92606ab780795fb5c56e46be73b2157

                                                                                                                                                              SHA1

                                                                                                                                                              b4b163acb8c7520b1d968b3a2b0dadbbf5dc0061

                                                                                                                                                              SHA256

                                                                                                                                                              e6ba409d71b8c7356ec4bece82282636c6b528c7cccb454e1ddc17f2f7e2523c

                                                                                                                                                              SHA512

                                                                                                                                                              f0108bddd2ae3198ce5336e9f784d1acd3809e9104b7af0993494d62ab2cab66a47e9b066547d65b32c127ecc3ef8f57c3b8cd02c59dbe5ab2da0692e453a7db

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              0ac7a17a25b0691379ef9d47b1698063

                                                                                                                                                              SHA1

                                                                                                                                                              bfa2178925068bc50b169e36690e36e1148b91f3

                                                                                                                                                              SHA256

                                                                                                                                                              2917cf3b5ca247ffe1b46fde4a6230134bd7195c98cb3c9f7f3ea7abf8e39a9c

                                                                                                                                                              SHA512

                                                                                                                                                              de6c677ab0e60fcacbc8d46c83f4a272091ae5c25cb0797831cfe93dda9c8e4ecf0ca1dd3498ef0585bc99a4595cbf1c67681c4067289392d86a0e44ff07cfb8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                              Filesize

                                                                                                                                                              1003KB

                                                                                                                                                              MD5

                                                                                                                                                              bc03f2d601e6ebd5e02d10195e2fbf99

                                                                                                                                                              SHA1

                                                                                                                                                              226f8d2c5984092d65bbb9dd90304ec79222b1fb

                                                                                                                                                              SHA256

                                                                                                                                                              c6ddd73ef39c3ddb70662305068f62abb7aa7d2b3fbfa822c1b8711c2d2ef76c

                                                                                                                                                              SHA512

                                                                                                                                                              6e84e3be5afc81aaf2454225d7a3dd0f6e03cc239d844ad923ea39da4fea96910214046368b40efdc889d8493a6ae950305eaaf04d0a225f25cc61809fc921cc

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              374441e33682a9826ac556fbb167be09

                                                                                                                                                              SHA1

                                                                                                                                                              a9140dd5974042d2b4516253153a35d9c0b491ae

                                                                                                                                                              SHA256

                                                                                                                                                              51dee2f29b1d0fe81879047dfdf4f8f134ccce0f9505d565dba9b828e4e4c8f0

                                                                                                                                                              SHA512

                                                                                                                                                              106dee06df62470b36def00e9f1b02f254c48870517dad0a4c8abbac56e67b887ecf16ea470122459cbe89b78dad0fc4b850c50ebbc49b34da9e438f8bd78b12

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              MD5

                                                                                                                                                              4d21c93f7e11f2772f3572801434792c

                                                                                                                                                              SHA1

                                                                                                                                                              49db72552b811b544e680083b50b53512f86b30e

                                                                                                                                                              SHA256

                                                                                                                                                              2832a0112a0a5504c815381995d0380ee994e73c6a863fa50f11b69507f152a2

                                                                                                                                                              SHA512

                                                                                                                                                              9688c6237163774d9bbddd35b8c84a13b55f06d42364b961c367df03a637a1fcfe5004b3140683eabea75e397ae19bfe9b706058cfa898d73db48a439157eebe

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              MD5

                                                                                                                                                              7d3721928be39d8133a121d20370447d

                                                                                                                                                              SHA1

                                                                                                                                                              ebef3e5bfb3d37df1eeaca08c4578536e6a14dc5

                                                                                                                                                              SHA256

                                                                                                                                                              d3f72211b921ee4aeac01ffa6f7f72b8048f92cc7fc23c225abe195ef0c24568

                                                                                                                                                              SHA512

                                                                                                                                                              738721fbfee86ad87a432f84d21985df76f9eccf51d0152ddfeac92df2f9c38377db3574fe90ddbb3e6eb95d47019117bcb293123744acbc387bb74600dbef3f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\VSSVC.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              MD5

                                                                                                                                                              36fc21580a978977875bb60f4287b4cf

                                                                                                                                                              SHA1

                                                                                                                                                              de1908cc4e89735af51aa90d24dab387aec16a5d

                                                                                                                                                              SHA256

                                                                                                                                                              fa514d97f6ec0222898eecbe9da09ac044f0575ef0a95ab34c6a98700d15eb1c

                                                                                                                                                              SHA512

                                                                                                                                                              e799fc8037f4137e7c3c484bb1ead10ac7841063dda6e69fa84bdd499620bbeb4e63adb0fd298741fffd633c4aa0cd335c928cd23d81ae20b943ff7fb8bc6b55

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\msdtc.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              46a3e41edd72ef7b811e1f365964cd3f

                                                                                                                                                              SHA1

                                                                                                                                                              4fcaae5d8f1f97f922b867a299e112b22c84cb23

                                                                                                                                                              SHA256

                                                                                                                                                              8109d2c2710a9b1aca8916edd44908a6604e4d241fb1ea234b44b5d8351d0cf2

                                                                                                                                                              SHA512

                                                                                                                                                              c7510362275eb84624a3854273ba138adc6a7c004775a164bfb0edf270ca21ae44b2cd5684144eda9b7b9ab5c44bc039468c39cfb5a55c67a6390365fe9bde34

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\snmptrap.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              MD5

                                                                                                                                                              a5c2cb1b1ee7cedc6ae43e4eaeaaf20f

                                                                                                                                                              SHA1

                                                                                                                                                              c607fda7bfb90446cfd98573e20e4f09421ee3f4

                                                                                                                                                              SHA256

                                                                                                                                                              347a4ed3895ee2faa0a110e89ed71f5e42bf8c39679eb7e10a80f909e37f87c3

                                                                                                                                                              SHA512

                                                                                                                                                              3ff63523ca3303e033e349a30efd107b1e14f25ec584eb39186b6e5185af46a27a57c981292fbb99e914cbad00b7a950df48571e175d0724e357501d2384bfbb

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\vds.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              MD5

                                                                                                                                                              15cd64cbb08bb2e52d63dbba2a8d8551

                                                                                                                                                              SHA1

                                                                                                                                                              0a0ecbd30de5c1f58e0f26923c7b3703ca39e573

                                                                                                                                                              SHA256

                                                                                                                                                              eed06af5332fef0a231ad4e0c77ae5b883febd1e377811202fef0fc871acedf5

                                                                                                                                                              SHA512

                                                                                                                                                              3da5b1647f784023714999200a0de58fe6ed9b245ea87a1129c6e58a67fe118a97f0a28c9290f1eb8c309d72f56ed9be8e876e41e21c0e6c9cc0ed50a7f1ed66

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              MD5

                                                                                                                                                              9b925c6afa9426c12d99b212c34244b0

                                                                                                                                                              SHA1

                                                                                                                                                              0af133310f5656300af8e6543571bb56ec826eb8

                                                                                                                                                              SHA256

                                                                                                                                                              296f2b9e30abf53eaaf17afa7b17abb08225cd2318dc6decea36ffc0d9da2b93

                                                                                                                                                              SHA512

                                                                                                                                                              a2a2d3655efcf688468139b31312f26a5c023134f05a34a6ebe6c7f341d2d33273cba3b2581242963225ebade65ccdfd43b12a7a538a95cc67092972eebd72ef

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\wbengine.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              MD5

                                                                                                                                                              03604e188f44cf7e1996768c624eeeeb

                                                                                                                                                              SHA1

                                                                                                                                                              929712dcf6f889ba2641f3d0da9f9d463bd8c7f3

                                                                                                                                                              SHA256

                                                                                                                                                              16f550f0df2a34dc6ccb315eaf87ceff95dc47e9ae355aa231018ac5a29a2418

                                                                                                                                                              SHA512

                                                                                                                                                              e34886bc743f2c77a9ffed0d1cc5778ad2f1f1259a24ec945684de8c4d1a9a6b2897c276f9a89eec76e8decf2b48b2aabe12a5759a5dff4b559dfbb4193abbdd

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Temp\Cab9BA3.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              29KB

                                                                                                                                                              MD5

                                                                                                                                                              d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                                              SHA1

                                                                                                                                                              e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                                              SHA256

                                                                                                                                                              a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                                              SHA512

                                                                                                                                                              17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Temp\Tar9DB8.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              81KB

                                                                                                                                                              MD5

                                                                                                                                                              b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                                              SHA1

                                                                                                                                                              7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                                              SHA256

                                                                                                                                                              725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                                              SHA512

                                                                                                                                                              f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              105KB

                                                                                                                                                              MD5

                                                                                                                                                              d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                              SHA1

                                                                                                                                                              9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                              SHA256

                                                                                                                                                              dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                              SHA512

                                                                                                                                                              5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              576KB

                                                                                                                                                              MD5

                                                                                                                                                              c4c52b36c457eef471a282640bf78b57

                                                                                                                                                              SHA1

                                                                                                                                                              a5a51f828ccf7d872ef21f1dda99eadf045a08ad

                                                                                                                                                              SHA256

                                                                                                                                                              78686ad2aef43492aaf9d3651eb357175b5dbcfbe5838295f7bf422c4b28abc5

                                                                                                                                                              SHA512

                                                                                                                                                              f2aa81d55dcfc97fd67aa5c0f9fe9a7ebda0f05bb64e9a28adbf51f6d7c76c330520691e60b9c06d98d5a10e2661d6245ad7999e6500863621de34a88d1a1c90

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              238KB

                                                                                                                                                              MD5

                                                                                                                                                              0a4ed78b7995d94fa42379f84cd5f8e9

                                                                                                                                                              SHA1

                                                                                                                                                              90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

                                                                                                                                                              SHA256

                                                                                                                                                              0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

                                                                                                                                                              SHA512

                                                                                                                                                              86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              248KB

                                                                                                                                                              MD5

                                                                                                                                                              4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                              SHA1

                                                                                                                                                              f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                              SHA256

                                                                                                                                                              c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                              SHA512

                                                                                                                                                              c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              MD5

                                                                                                                                                              9958f23efa2a86f8195f11054f94189a

                                                                                                                                                              SHA1

                                                                                                                                                              78ec93b44569ea7ebce452765568da5c73511931

                                                                                                                                                              SHA256

                                                                                                                                                              3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

                                                                                                                                                              SHA512

                                                                                                                                                              3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              1.0MB

                                                                                                                                                              MD5

                                                                                                                                                              598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                                              SHA1

                                                                                                                                                              5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                                              SHA256

                                                                                                                                                              e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                                              SHA512

                                                                                                                                                              774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\05e4e2e2737451dd73e83703c416f2fa\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              122KB

                                                                                                                                                              MD5

                                                                                                                                                              596879be622d0e30de4a5d24f401c269

                                                                                                                                                              SHA1

                                                                                                                                                              648ca774a39f7e597066b6b6d366fbabdd782c12

                                                                                                                                                              SHA256

                                                                                                                                                              f4bf0764a82c0daba8c1d3889619fd51ad91934029bd9c1d368e2c4ea7a1d67e

                                                                                                                                                              SHA512

                                                                                                                                                              75f1ed25e6ea7e56f908a13842ba5496b7102d7ecfedb5bbf61b20aaeb8c4bea6aeba70d38ad03632860a2de949febeca7106146b26c2693606f6ede34dd52fd

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              58KB

                                                                                                                                                              MD5

                                                                                                                                                              3d6987fc36386537669f2450761cdd9d

                                                                                                                                                              SHA1

                                                                                                                                                              7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                              SHA256

                                                                                                                                                              34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                              SHA512

                                                                                                                                                              1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              205KB

                                                                                                                                                              MD5

                                                                                                                                                              0a41e63195a60814fe770be368b4992f

                                                                                                                                                              SHA1

                                                                                                                                                              d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                              SHA256

                                                                                                                                                              4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                              SHA512

                                                                                                                                                              1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0bda95ff54333d4b6ba1dbec26a89963\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              221KB

                                                                                                                                                              MD5

                                                                                                                                                              999ac47fc2c55ddd78b7fe4df3e3802f

                                                                                                                                                              SHA1

                                                                                                                                                              5005e7bdf5d8f60ed9a07099833dc5325110e4ce

                                                                                                                                                              SHA256

                                                                                                                                                              50c3634cda10645d2b52df2c3a22b5443c8328ddb592edf9d03681bfd40e0add

                                                                                                                                                              SHA512

                                                                                                                                                              30685bc7038d2d933993fef51294e3fde501751e9a7375199968e006a05ae730701fabe33fa6f5cd85fdfa5e288db495195cf29b73ed82b777a149918a8a75c1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\1c736c423c3d55ed4bd7d0144887419d\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              305KB

                                                                                                                                                              MD5

                                                                                                                                                              b20e181de34bc4249248adc1d571acbd

                                                                                                                                                              SHA1

                                                                                                                                                              e89fb06f79782929ed94e73af28e62fae5f7bebd

                                                                                                                                                              SHA256

                                                                                                                                                              0966665c285744a9c6d02836679b89122f2370a343b4d48cda8231c567f50849

                                                                                                                                                              SHA512

                                                                                                                                                              5edc4841c5dc308958faecbec9b31547aa503cba6709ea76abbfd242d4f94bfd9d4d84cadb69e180a78f5dd24263a836283eebc2a5d6e222c2d51c99dcb1c840

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              43KB

                                                                                                                                                              MD5

                                                                                                                                                              68c51bcdc03e97a119431061273f045a

                                                                                                                                                              SHA1

                                                                                                                                                              6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                              SHA256

                                                                                                                                                              4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                              SHA512

                                                                                                                                                              d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              198KB

                                                                                                                                                              MD5

                                                                                                                                                              9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                              SHA1

                                                                                                                                                              ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                              SHA256

                                                                                                                                                              469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                              SHA512

                                                                                                                                                              58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              70KB

                                                                                                                                                              MD5

                                                                                                                                                              57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                              SHA1

                                                                                                                                                              da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                              SHA256

                                                                                                                                                              1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                              SHA512

                                                                                                                                                              1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              87KB

                                                                                                                                                              MD5

                                                                                                                                                              ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                              SHA1

                                                                                                                                                              4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                              SHA256

                                                                                                                                                              b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                              SHA512

                                                                                                                                                              d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              82KB

                                                                                                                                                              MD5

                                                                                                                                                              2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                              SHA1

                                                                                                                                                              66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                              SHA256

                                                                                                                                                              37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                              SHA512

                                                                                                                                                              cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a1f6d991b0c0e7ce24817247cb7b54d2\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              271KB

                                                                                                                                                              MD5

                                                                                                                                                              81845c3ae13fdd4f90f7df4520b7060a

                                                                                                                                                              SHA1

                                                                                                                                                              0442f25cb8fe2e7e66480bbe43927f674e17e97e

                                                                                                                                                              SHA256

                                                                                                                                                              a6d9b30ede31d5374a2109b93ada97db59c1b9bf5933d349a52fc1a5f693ec0a

                                                                                                                                                              SHA512

                                                                                                                                                              86517490df531e78e2ef7c3e22736ba9661e812e755538647376a7bf3ff271177847472e8e10c03d18074ddb594f360121159366957f91646d1f509e2c752612

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              58KB

                                                                                                                                                              MD5

                                                                                                                                                              a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                              SHA1

                                                                                                                                                              500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                              SHA256

                                                                                                                                                              1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                              SHA512

                                                                                                                                                              b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              85KB

                                                                                                                                                              MD5

                                                                                                                                                              5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                              SHA1

                                                                                                                                                              dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                              SHA256

                                                                                                                                                              d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                              SHA512

                                                                                                                                                              27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              298KB

                                                                                                                                                              MD5

                                                                                                                                                              5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                              SHA1

                                                                                                                                                              1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                              SHA256

                                                                                                                                                              5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                              SHA512

                                                                                                                                                              58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              43KB

                                                                                                                                                              MD5

                                                                                                                                                              dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                              SHA1

                                                                                                                                                              d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                              SHA256

                                                                                                                                                              f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                              SHA512

                                                                                                                                                              8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              124KB

                                                                                                                                                              MD5

                                                                                                                                                              929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                              SHA1

                                                                                                                                                              993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                              SHA256

                                                                                                                                                              2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                              SHA512

                                                                                                                                                              effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              MD5

                                                                                                                                                              10b5a285eafccdd35390bb49861657e7

                                                                                                                                                              SHA1

                                                                                                                                                              62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                              SHA256

                                                                                                                                                              5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                              SHA512

                                                                                                                                                              19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              88KB

                                                                                                                                                              MD5

                                                                                                                                                              1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                              SHA1

                                                                                                                                                              4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                              SHA256

                                                                                                                                                              9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                              SHA512

                                                                                                                                                              e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\ehome\ehrecvr.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              MD5

                                                                                                                                                              0a312603e91edccdf38c33ecd947fe2b

                                                                                                                                                              SHA1

                                                                                                                                                              aa6076c9ab93414d2eff4c4ed4f1d5888c0fb5f2

                                                                                                                                                              SHA256

                                                                                                                                                              182df79f6cd15d3adb5e145d32fb176a1d5021711926adcb7c5fd70bb516e1a6

                                                                                                                                                              SHA512

                                                                                                                                                              e0c90f6e9ed6ff389008998369921da9bdd39579a944e80f7dedbdcbfdc7e2fb7aec171b32fda08834b4649f49a2cf30be8a84fef0165e61349dc20ab71a0fd1

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              4b48462c4ffca54c7587cdbe25a793ee

                                                                                                                                                              SHA1

                                                                                                                                                              ebd15bee669b3cb15f8cc828eee0c2ea1165a28d

                                                                                                                                                              SHA256

                                                                                                                                                              df1129fc61b4109137bd1ab07d55541de5e74e02b7c281cc0742c2bde45a2989

                                                                                                                                                              SHA512

                                                                                                                                                              cf19ac7db8964cf57f839d0efe63658d397b5f6b133ca864ab0a346165019eed21fa4b58ffbe7a226e01f6496ff075264856dd70f6b8d53c5d6678239e8b759e

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              MD5

                                                                                                                                                              aed2ff4d04d9504cfee905e4da683f58

                                                                                                                                                              SHA1

                                                                                                                                                              5cdd20f9737b4c88ab1bd639d443ddc6afb61658

                                                                                                                                                              SHA256

                                                                                                                                                              fbe30aeb2deb2cfbb541e0695f3b203e296b722e47be8e07e0ef0407e94b0900

                                                                                                                                                              SHA512

                                                                                                                                                              55610572281a9bb9a0f2626637643cf916c7fdc894983f00ac558496c10074426109144983cac0c04c640371a3bbbcb5a7095ba274c4f2bb8690dc5300d592a2

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\Locator.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              MD5

                                                                                                                                                              027165189ec419729e0e042035d7b4cb

                                                                                                                                                              SHA1

                                                                                                                                                              80f75a1d587acdd09f7061143cadf6e00a736f49

                                                                                                                                                              SHA256

                                                                                                                                                              95859446ad898a90fd1f0bbc95491430c186fccbf3987b9746c3518ea783ed5c

                                                                                                                                                              SHA512

                                                                                                                                                              0b7d3523b3250480591a520dd504efdf920a4f8e9df8e59db913183439274c49c1f208ffd3477e64bdc24a8f8b53b96a57274712b24cf2de3e803c236cbe27da

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\alg.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              f8f1d9f2b6245188aff252d9f09bdcb7

                                                                                                                                                              SHA1

                                                                                                                                                              9c7d84d6ddc2ccfed2a726336746562de467ce32

                                                                                                                                                              SHA256

                                                                                                                                                              a600771ac904b8e8f8240885ccafac0e10303d3ba73d67b28e7dd71441801e7c

                                                                                                                                                              SHA512

                                                                                                                                                              7cae473b00483d9ee1d11aeaffaea24d0c69c111ba73ff226ba1f939dc02d60a16fc13c180bca1c8c9d4f85db1adffd68d776cad8fb7177cf6c0f3deba1d178a

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\ieetwcollector.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              d71b490c5f35d1e75e606ba39c090ddc

                                                                                                                                                              SHA1

                                                                                                                                                              ee176a57a5bc3eaef92d67f8810bfa6b435d42a2

                                                                                                                                                              SHA256

                                                                                                                                                              1be5ff29b7c60b7afef05bc288be31034956e14cadf9643b2b3cf7a280e8eab2

                                                                                                                                                              SHA512

                                                                                                                                                              901f213479fb0e6efbfd7e7125287c76350b98a865e505c4a2de8bf0701b2e5c299c61095616820d5c26922f2006fabe4d53eee4f8f2f4d9b4ca9d86db86ac44

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\msiexec.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              0285f4b3b9ee9e9ed9f3836c0b6db534

                                                                                                                                                              SHA1

                                                                                                                                                              539f6b81a39c2eb503faafabaa87eec7ea7a4f38

                                                                                                                                                              SHA256

                                                                                                                                                              05bd7572120f7f5bbdae49ed5f81cdd0a293c811586d25b427422bed8025f652

                                                                                                                                                              SHA512

                                                                                                                                                              18c1dfd9883f1a3f46b4aa5dd01b05f4312690cdfd7c7304254b2cfe142e801c498746b297b0501ffe9b0300b1d72b49e9fcd9fea497627429b313820266e4b3

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\ehome\ehsched.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              9d269505ec1b4186c83ace20b440263c

                                                                                                                                                              SHA1

                                                                                                                                                              574b37798c4cbdb7ea22ef396844e275f9d948e1

                                                                                                                                                              SHA256

                                                                                                                                                              204922c5e9056517dd2216a8ef488bf46c848a28a99241ac9f0c1c6e618dbb75

                                                                                                                                                              SHA512

                                                                                                                                                              b90a85314cc5457f1dc5fbf25acaeebdb8a4ecc9593ccc00e7c8ad3cc259ebd2d3a99b94ef729d0497ec326d3d0894f5e820edf7bdf8764c7ccee0e2c989bb38

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/280-164-0x0000000140000000-0x000000014018C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/280-178-0x0000000140000000-0x000000014018C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/324-479-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/324-517-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/544-194-0x00000000006A0000-0x0000000000814000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/544-308-0x0000000100000000-0x0000000100174000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/544-183-0x0000000100000000-0x0000000100174000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/544-321-0x00000000006A0000-0x0000000000814000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/556-233-0x0000000001000000-0x0000000001157000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/556-365-0x0000000001000000-0x0000000001157000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/664-280-0x0000000140000000-0x000000014016F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/664-306-0x0000000140000000-0x000000014016F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/892-167-0x0000000140000000-0x0000000140177000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/892-300-0x0000000140000000-0x0000000140177000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/928-573-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/928-595-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1012-591-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1012-614-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1012-737-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1012-738-0x0000000003CA0000-0x0000000003D5A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              744KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1012-750-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1068-627-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1068-653-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1072-526-0x0000000100000000-0x00000001001D6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1072-292-0x0000000100000000-0x00000001001D6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1092-667-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1092-679-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1108-666-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1108-376-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1144-547-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1144-528-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1164-572-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1164-315-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1236-162-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              30.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1236-278-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              30.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1244-232-0x0000000140000000-0x0000000140173000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1244-111-0x0000000000850000-0x00000000008B0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1244-104-0x0000000140000000-0x0000000140173000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1244-105-0x0000000000850000-0x00000000008B0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1244-782-0x0000000140000000-0x0000000140173000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1396-611-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1396-618-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1488-247-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1488-128-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1488-118-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1488-124-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1560-293-0x0000000140000000-0x000000014016F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1560-348-0x0000000140000000-0x000000014016F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1688-92-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1688-99-0x0000000000860000-0x00000000008C0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1688-212-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1688-114-0x0000000001390000-0x00000000013A0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1688-93-0x0000000000860000-0x00000000008C0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1688-113-0x0000000001380000-0x0000000001390000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1692-61-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1692-60-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1692-67-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1692-185-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1792-698-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1792-719-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1860-658-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1860-768-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1860-746-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1860-654-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1968-203-0x000000002E000000-0x000000002E177000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1968-342-0x000000002E000000-0x000000002E177000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2004-373-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2004-460-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2060-590-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2060-330-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2148-734-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2148-721-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2200-1-0x0000000000360000-0x00000000003C7000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2200-0-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2200-8-0x0000000000360000-0x00000000003C7000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2200-91-0x0000000000400000-0x00000000005D9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2216-680-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2216-689-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2340-139-0x0000000140000000-0x0000000140170000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2340-873-0x0000000140000000-0x0000000140170000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2340-251-0x0000000140000000-0x0000000140170000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2392-576-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2392-543-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-47-0x0000000010000000-0x0000000010169000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-68-0x0000000010000000-0x0000000010169000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2588-31-0x00000000002F0000-0x0000000000357000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2588-53-0x0000000010000000-0x0000000010161000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2588-37-0x00000000002F0000-0x0000000000357000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2588-36-0x00000000002F0000-0x0000000000357000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2588-30-0x0000000010000000-0x0000000010161000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2612-126-0x0000000100000000-0x0000000100165000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2612-21-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2612-20-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2612-13-0x0000000100000000-0x0000000100165000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2612-14-0x0000000000840000-0x00000000008A0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2788-75-0x0000000140000000-0x000000014016F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2788-82-0x0000000000AE0000-0x0000000000B40000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2788-76-0x0000000000AE0000-0x0000000000B40000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2788-197-0x0000000140000000-0x000000014016F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2832-358-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2832-626-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2856-150-0x0000000140000000-0x000000014015E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2856-27-0x0000000140000000-0x000000014015E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2900-609-0x0000000100000000-0x0000000100186000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2900-344-0x0000000100000000-0x0000000100186000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2936-249-0x0000000100000000-0x0000000100156000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2936-375-0x0000000100000000-0x0000000100156000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2956-452-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2956-490-0x0000000000400000-0x000000000056A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2960-444-0x0000000100000000-0x0000000100157000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2960-281-0x0000000100000000-0x0000000100157000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-222-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-362-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.3MB

                                                                                                                                                              Download