Overview

overview

7

Static

static

3

2024-06-27...uk.exe

windows7-x64

7

2024-06-27...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 07:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-27_584ee8b58b84938f456fbdb28142f750_ryuk.exe

  • Size

    2.0MB

  • MD5

    584ee8b58b84938f456fbdb28142f750

  • SHA1

    e3633d1e7199589aa1998bc56e9e3affe3ce2c79

  • SHA256

    461f6e9cc5c14418ee61e7f2479dec8bce5a95f174e2b5342033286abb035e68

  • SHA512

    4395d74577654ce35f4405c84db4e83c1819da3415978c768f15b7aff2dc3d4e4827d368d296adda9bb4e6366b297d5265cb4b3fb692835a09860c107cc2617c

  • SSDEEP

    49152:c2AnkV4pirBKiyq6kWISQEBVRbgnHyNJslRG7y00ibS:c2AnxpirB1N2mnH5x00ibS

Score
7/10
bootkitpersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 57 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-27_584ee8b58b84938f456fbdb28142f750_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-27_584ee8b58b84938f456fbdb28142f750_ryuk.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1612
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2588
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2568
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2072
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2500
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1592
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 244 -NGENProcess 248 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1552
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 258 -NGENProcess 1ec -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 1d4 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 244 -NGENProcess 264 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2252
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 244 -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 254 -NGENProcess 264 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1160
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 26c -NGENProcess 248 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1552
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 264 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1932
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 260 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 264 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1192
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 248 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 260 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2972
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 264 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1096
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 248 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 260 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1236
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 264 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:948
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 248 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2752
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 260 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2924
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 264 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2564
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2904
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1888
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 1fc -NGENProcess 1ac -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2924
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 258 -NGENProcess 228 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3032
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1352
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 1ac -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1312
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 228 -Pipe 1b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1356
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 228 -NGENProcess 25c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1432
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 270 -NGENProcess 264 -Pipe 22c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2936
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 264 -NGENProcess 268 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2484
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 278 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:684
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 25c -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1932
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 280 -NGENProcess 268 -Pipe 228 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2124
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 268 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2652
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 288 -NGENProcess 270 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:800
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 280 -NGENProcess 290 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
        PID:2564
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1ac -NGENProcess 270 -Pipe 25c -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2796
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 280 -NGENProcess 298 -Pipe 28c -Comment "NGen Worker Process"
        2⤵
          PID:2780
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1fc -NGENProcess 270 -Pipe 26c -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2312
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 280 -NGENProcess 294 -Pipe 284 -Comment "NGen Worker Process"
          2⤵
            PID:2180
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 278 -NGENProcess 29c -Pipe 288 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1400
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 1fc -NGENProcess 2a8 -Pipe 280 -Comment "NGen Worker Process"
            2⤵
              PID:1996
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 290 -NGENProcess 29c -Pipe 1ac -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2248
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 29c -NGENProcess 2a4 -Pipe 278 -Comment "NGen Worker Process"
              2⤵
                PID:2532
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2b0 -NGENProcess 2a8 -Pipe 2a0 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:1700
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2a8 -NGENProcess 290 -Pipe 2ac -Comment "NGen Worker Process"
                2⤵
                  PID:2828
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 270 -NGENProcess 294 -Pipe 2a4 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:544
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2a8 -Comment "NGen Worker Process"
                  2⤵
                    PID:1788
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 1fc -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:1888
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 294 -NGENProcess 2bc -Pipe 270 -Comment "NGen Worker Process"
                    2⤵
                      PID:1924
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2c8 -NGENProcess 2c0 -Pipe 2b4 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:1028
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 1fc -NGENProcess 2d0 -Pipe 294 -Comment "NGen Worker Process"
                      2⤵
                        PID:2988
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 29c -NGENProcess 2c0 -Pipe 2b0 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:2040
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2c0 -NGENProcess 2cc -Pipe 2c8 -Comment "NGen Worker Process"
                        2⤵
                          PID:1032
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2d8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2132
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2d0 -NGENProcess 29c -Pipe 2d4 -Comment "NGen Worker Process"
                          2⤵
                            PID:1884
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2e0 -NGENProcess 2cc -Pipe 1fc -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2508
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2d0 -Comment "NGen Worker Process"
                            2⤵
                            • Modifies data under HKEY_USERS
                            PID:2872
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 290 -NGENProcess 2cc -Pipe 2c0 -Comment "NGen Worker Process"
                            2⤵
                              PID:272
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2ec -NGENProcess 2e0 -Pipe 2bc -Comment "NGen Worker Process"
                              2⤵
                                PID:832
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2c4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2848
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f8 -NGENProcess 2cc -Pipe 2f4 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2072
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2dc -NGENProcess 29c -Pipe 2e0 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1948
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 29c -NGENProcess 2f0 -Pipe 2d8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1200
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2f0 -NGENProcess 2e4 -Pipe 2cc -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1220
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 304 -NGENProcess 2fc -Pipe 2ec -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:2272
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2fc -NGENProcess 29c -Pipe 300 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:272
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 30c -NGENProcess 2e4 -Pipe 2dc -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2292
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 308 -Pipe 290 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1920
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 29c -Pipe 2f0 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1396
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2e4 -Pipe 2f8 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2480
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 318 -NGENProcess 314 -Pipe 308 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2724
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 304 -NGENProcess 2e4 -Pipe 2fc -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1896
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 324 -NGENProcess 310 -Pipe 2e8 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1112
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 318 -NGENProcess 314 -Pipe 324 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:1584
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 32c -NGENProcess 2e4 -Pipe 30c -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2488
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 304 -NGENProcess 328 -Pipe 334 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2848
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 31c -NGENProcess 330 -Pipe 310 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2180
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 338 -NGENProcess 2e4 -Pipe 29c -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:1644
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 328 -Pipe 320 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2388
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 330 -Pipe 318 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2028
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2e4 -Pipe 32c -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:1524
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 328 -Pipe 304 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2972
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 330 -Pipe 31c -Comment "NGen Worker Process"
                                                                        2⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:2720
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2e4 -Pipe 338 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2968
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 328 -Pipe 33c -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2924
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 330 -Pipe 340 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2032
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2e4 -Pipe 344 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1444
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 328 -Pipe 348 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2948
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 330 -Pipe 34c -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                  • Loads dropped DLL
                                                                                  • Drops file in Windows directory
                                                                                  PID:2664
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 330 -NGENProcess 35c -Pipe 2e4 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2192
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 35c -NGENProcess 360 -Pipe 370 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:736
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 354 -NGENProcess 36c -Pipe 358 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2088
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 374 -NGENProcess 364 -Pipe 314 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2448
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 360 -Pipe 328 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:1748
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 36c -Pipe 350 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2912
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 364 -Pipe 330 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2648
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 360 -Pipe 35c -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1040
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 36c -Pipe 354 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2844
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 380 -NGENProcess 390 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2828
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 374 -NGENProcess 36c -Pipe 378 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1404
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 394 -NGENProcess 388 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2280
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 390 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2072
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 36c -Pipe 364 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:1548
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 388 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:1200
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 390 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2936
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 36c -Pipe 374 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2644
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 388 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1412
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 390 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2036
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 36c -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2660
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 388 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2584
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 390 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2236
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 36c -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2308
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 388 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:2580
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 390 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2272
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 36c -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2240
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 388 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1704
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 390 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1788
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 36c -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2492
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d8 -NGENProcess 3d4 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1312
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3c4 -NGENProcess 36c -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1200
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 3dc -NGENProcess 3e4 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:3032
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 420 -NGENProcess 424 -Pipe 42c -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1352
                                                                                                                                        • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                          C:\Windows\ehome\ehRecvr.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:1004
                                                                                                                                        • C:\Windows\ehome\ehsched.exe
                                                                                                                                          C:\Windows\ehome\ehsched.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2036
                                                                                                                                        • C:\Windows\eHome\EhTray.exe
                                                                                                                                          "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                          1⤵
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                          PID:1928
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3012
                                                                                                                                        • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                          C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2844
                                                                                                                                        • C:\Windows\ehome\ehRec.exe
                                                                                                                                          C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:800
                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                          "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:1944
                                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1660
                                                                                                                                        • C:\Windows\System32\msdtc.exe
                                                                                                                                          C:\Windows\System32\msdtc.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:1620
                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:1824
                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1532
                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:2760
                                                                                                                                        • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                          C:\Windows\SysWow64\perfhost.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3004
                                                                                                                                        • C:\Windows\system32\locator.exe
                                                                                                                                          C:\Windows\system32\locator.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2596
                                                                                                                                        • C:\Windows\System32\snmptrap.exe
                                                                                                                                          C:\Windows\System32\snmptrap.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2452
                                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                                          C:\Windows\System32\vds.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2396
                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2144
                                                                                                                                        • C:\Windows\system32\wbengine.exe
                                                                                                                                          "C:\Windows\system32\wbengine.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2536
                                                                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1540
                                                                                                                                        • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                          "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2268
                                                                                                                                        • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2404
                                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                            2⤵
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:3028
                                                                                                                                          • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                            "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:884
                                                                                                                                        • C:\Windows\system32\dllhost.exe
                                                                                                                                          C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1464

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                          Filesize

                                                                                                                                          1.4MB

                                                                                                                                          MD5

                                                                                                                                          192893fbf8994cc02c8d41bc9ccc707a

                                                                                                                                          SHA1

                                                                                                                                          aab69e896b50b4afefacfce83eeb6e8e371b96fa

                                                                                                                                          SHA256

                                                                                                                                          8d98a6fb91120f0ea8aac9cf682e5f340808b13484d44d0eec0e5b40b50b03ef

                                                                                                                                          SHA512

                                                                                                                                          ede595aeb8d86c2af4165b4ee6d68fd5f7179d4b06228ef35183fea4fb034d10210a778dc7b90606505dc7301229f149fd8a58355722104f3448c9cce4f23b0e

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                          Filesize

                                                                                                                                          30.1MB

                                                                                                                                          MD5

                                                                                                                                          36f76a99d595a7189b4af7c197401051

                                                                                                                                          SHA1

                                                                                                                                          3f37d5b96348568961b993044964456f38458bbe

                                                                                                                                          SHA256

                                                                                                                                          0c39b87b52e16e3a38a6c5fafcc66e545f7a1ea79758370e6b82af42517452fc

                                                                                                                                          SHA512

                                                                                                                                          b9f233e5102fac3511e9b184c55b4babbcbb1daabe68f02ec2d3596187aaa712d1e45d133b64d4accb4035fe013aa9e837039573c4bf120be0d2331785b14c7c

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                          Filesize

                                                                                                                                          1.4MB

                                                                                                                                          MD5

                                                                                                                                          a19240ffb5f8a1b7e7fb77f1cb791e2a

                                                                                                                                          SHA1

                                                                                                                                          98390d2e6fe4c15e7bbcf44e59e5a435b4dda3da

                                                                                                                                          SHA256

                                                                                                                                          c134f1473a49f2578107ca83e6db8c5e6da930794ed35a790890a9c8ea5e318d

                                                                                                                                          SHA512

                                                                                                                                          fce5a86df3f88d960cb5bad626ecaeeaf19398ed9e23eb113e25eae958097868f6e5661c9198aaa45ffa17faa3960654306785ef052e616b9c82da8a2d14c5db

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                          Filesize

                                                                                                                                          5.2MB

                                                                                                                                          MD5

                                                                                                                                          a6429fb4d85d630361924aa060b1cc36

                                                                                                                                          SHA1

                                                                                                                                          c188e1ac7e5bb2ab9ff6a36e6f61f809783a0123

                                                                                                                                          SHA256

                                                                                                                                          88c929625201ecc74b0039c559303e1954194eac4931b44167c9c1f3652f55e8

                                                                                                                                          SHA512

                                                                                                                                          42e4c225ab8f5a6956fb33ff7f1a5ef2abdf6842a418e56749cefbd7b1f1c9e31e9dfedfccb4901278b6f6c04184a17dcf80e3185b2a18df7259f8747a3f9277

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          MD5

                                                                                                                                          874b404568461fe1ab8c82cf52e8de48

                                                                                                                                          SHA1

                                                                                                                                          81d96ef0155997ec554337fc7ba1dbefdbd05f24

                                                                                                                                          SHA256

                                                                                                                                          c63d82fcaf56e4336ea7f11e91f8f40239ca0bc892d91510b1d6a18cd2ac3940

                                                                                                                                          SHA512

                                                                                                                                          7a4d307316211f63d857cbe20b1d3e2206b097be9305305c2129e5d775cbb93742b06c6dd5f76bceb86c83e45aceed26085363f04df9f1369959c8e2533ebc41

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          MD5

                                                                                                                                          5979a2f56cf096c97e6ca3a35427e386

                                                                                                                                          SHA1

                                                                                                                                          29a421c8a278be899f37adf0d2e2ac7df22af480

                                                                                                                                          SHA256

                                                                                                                                          5a29974ee6c5593508f7b879160553b348e05386f676782a2efc504e1d3ca4aa

                                                                                                                                          SHA512

                                                                                                                                          3cd1f9a6c6e443edf529af518fff26315475f4260499e92496871e27f677a364ee2f36cc2563673640f6811c9fcac2f5ebec51ca1dd1e1df2ea653a7c7b310ed

                                                                                                                                          Download Submit

                                                                                                                                        • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                          Filesize

                                                                                                                                          1024KB

                                                                                                                                          MD5

                                                                                                                                          7655a71129c86eaa0ed0888804c6c767

                                                                                                                                          SHA1

                                                                                                                                          dc466e30a2185269f8f9cf6bbb503295874e02b7

                                                                                                                                          SHA256

                                                                                                                                          87ab1f1c9b876082959b590e542e3559241c2142493ac88330e30547b22df759

                                                                                                                                          SHA512

                                                                                                                                          52ba427b6748b42092a47b0458de46e9981455ad24abb63b36a6889e09e72f192aa4494030c998875fc0c4026326a3b68289f070b914c350e9e38e8a2cb47b3a

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                          Filesize

                                                                                                                                          24B

                                                                                                                                          MD5

                                                                                                                                          b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                          SHA1

                                                                                                                                          9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                          SHA256

                                                                                                                                          7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                          SHA512

                                                                                                                                          cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          bc1c67aaafef9499c3b3ce2d526b6cc6

                                                                                                                                          SHA1

                                                                                                                                          8286222a483c7406c8633f4d79315b548b8b6e39

                                                                                                                                          SHA256

                                                                                                                                          e27bcc598db894664e05ac6a5795a17605ba0cfe0b81bc8c0162f3346fcf146f

                                                                                                                                          SHA512

                                                                                                                                          fbc30cb2cd7ce0ee270bb002adfd961fc33d1da3820da27c730751cf0b2abc74a0c8a22263b958f154939ce5f61d3fccb54bcd647dbc713992e4a284e9843da7

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                          Filesize

                                                                                                                                          872KB

                                                                                                                                          MD5

                                                                                                                                          e7804f9ca0923f263aaf5db3a8fcf611

                                                                                                                                          SHA1

                                                                                                                                          1714e496f006e44d08d2cba56b0c9e2ab87eba27

                                                                                                                                          SHA256

                                                                                                                                          1b2f7efde3876c1b238ca17ba5f485741f88b65a75d785977a7810e69a64c8e2

                                                                                                                                          SHA512

                                                                                                                                          1fc54c2ecf1edbb37ff98a14e9b8141d991792c16b435cedbdbe3e72e1909d2d7dc20a8959a46a8919e6c94239208d7ce7300a45aab174ec6f3d7fb20c4e9f48

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          533520d39b5ac83e8b6af84d06567a74

                                                                                                                                          SHA1

                                                                                                                                          f12fccb04966685d3ee6205c99d51f67a46aa569

                                                                                                                                          SHA256

                                                                                                                                          3866630d919edc01d63dd4a605acacb6c096a82a3da99e984a65a7d4a9465a71

                                                                                                                                          SHA512

                                                                                                                                          290ce94f5534155e4898e49a17dc458afa2c36440d26dac867e053c112ad1a01883cd3bfa0e7ced7d638df6a8c09840487c8573571c9a333f01acfc8d92942bd

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                          MD5

                                                                                                                                          d66bf5bbfb65b65319786a99c91c9df6

                                                                                                                                          SHA1

                                                                                                                                          a16b2a2ad7c426f4ad81c25fb731e74df1982223

                                                                                                                                          SHA256

                                                                                                                                          9a259d038a3ddd4dc5c645c899e760cb2756c265b62a23a941f948d6984f02be

                                                                                                                                          SHA512

                                                                                                                                          1c3ad333033cf6560eb91ced0a7607aa59547e483783144f3a54e77d723017447754918c70156ec0fdca1f16ba86f65221a30ddea8f1c8d2fbb6d58df0d7784d

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          353829c3dc355bf2750e72a0bb1b3373

                                                                                                                                          SHA1

                                                                                                                                          32ec8cf82c64bb2f7c22b3008cd741c2271a98f3

                                                                                                                                          SHA256

                                                                                                                                          73da7feca94eeacb75ad7561eb10d01e24b4a51237856d40d696b73362f77f5f

                                                                                                                                          SHA512

                                                                                                                                          62396a39e521edbb5818876be641645205088732d06d0d537f88529efae1631888ca7431250fe335ecb75dbf6e3420d4591c9170418864381110621e442f4a0e

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                          Filesize

                                                                                                                                          1003KB

                                                                                                                                          MD5

                                                                                                                                          315306c4c2bb3c17f12eaa73622ff7bf

                                                                                                                                          SHA1

                                                                                                                                          1565afe45b13b82df1edf68e5355f76a2b3a3ba4

                                                                                                                                          SHA256

                                                                                                                                          25c7f9d280f71e867bbf419c692f2691489dada64a911ce49897903749cb35b9

                                                                                                                                          SHA512

                                                                                                                                          ceda78be27d9d83ca59aafd1b8d2cbe91c5bbd61c7c5d0a5ec68081f68c54af0cc00da96aef4b558738d016af8a80c2f505652a71b350ce61850b5b7f8b521b7

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          c6f234d398a68e5896eaa52c956d8186

                                                                                                                                          SHA1

                                                                                                                                          b69a9dae56206b809d73fb7d137dbfe520bcaabd

                                                                                                                                          SHA256

                                                                                                                                          1bc8c30e07ab9c538c63d54c02c896606c80b6cb0e00cc588515795bdf5f5018

                                                                                                                                          SHA512

                                                                                                                                          b5e0f89e490cfdc877fc2986a783612b879ef411c983e99aff051809257bd24f135f21e0e575d340ef4108c3e2682e2e441cc99c78460a904de3847890013cde

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          bd34630312c058e69e45e642236cc8e0

                                                                                                                                          SHA1

                                                                                                                                          d0290543cc789883cb3aef85e86a87145a51d230

                                                                                                                                          SHA256

                                                                                                                                          439a37a188fc77c8e0d2d5ea3ff7c997f27fe7bfc46cb2786f0cb76e37e2cc65

                                                                                                                                          SHA512

                                                                                                                                          d6203540aa7c675f62e6ad9260ed67c124d8d49eae24b33ed35df1b4fb99463ef808cd6be8ba8822f53affab18aac82a9a5f7e6d5a0cacfa344be57f329fe79e

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\System32\Locator.exe
                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          4c71465ead5140888d7de00c708ac21a

                                                                                                                                          SHA1

                                                                                                                                          aa423b11f008f714111229cf2acf32e9c3bc05cc

                                                                                                                                          SHA256

                                                                                                                                          3cffec5a88a150f3e93d5eeec17d4ba334126727c460194aa696ddf4183a493d

                                                                                                                                          SHA512

                                                                                                                                          a5b476538635e7904d2f47573e7219a7d5c136601016bfcc646074112426771c4dcc68b14fe0fa1bd338b414ad0afa330c4b1fd54ae42523db9e4fe65a7e8812

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\System32\SearchIndexer.exe
                                                                                                                                          Filesize

                                                                                                                                          1.1MB

                                                                                                                                          MD5

                                                                                                                                          04bb026730b0466e40a373e41e22331e

                                                                                                                                          SHA1

                                                                                                                                          c0e489c6a5e32cf056280eebb244b35fc80a281d

                                                                                                                                          SHA256

                                                                                                                                          06e78db3f7fb6caeac3314639b62d9a72ab75735db3322352ca62d566a43c9fa

                                                                                                                                          SHA512

                                                                                                                                          5295bbb61bd39feed2ef13d611cbe9860d63089c5986d5ef22d97d75a3f23e081368bad3a4d85cf818e65bd682755e687a77bdcec9dc0a4785775988224f8981

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\System32\VSSVC.exe
                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          MD5

                                                                                                                                          82de5641ed26abe90656a77e93e2b797

                                                                                                                                          SHA1

                                                                                                                                          d2e9bfea14af15a53b9649e560f297163a78246c

                                                                                                                                          SHA256

                                                                                                                                          142e73074eb53fa62affbd4e07225b9aa27167cf89dad44236cc3934b8661e21

                                                                                                                                          SHA512

                                                                                                                                          63bf1c1f03a750d950a8fd368bacde3a109bb53dc272904dd1c75dd09846141574a9b14763b14abf3aca5c7b538564211022d3ce5e069f488eaa3cb7c5dcfd28

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\System32\ieetwcollector.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          363b08a56cea85be8a44659b5b25676f

                                                                                                                                          SHA1

                                                                                                                                          4803082afca797784d19063d81d79885a16e33b8

                                                                                                                                          SHA256

                                                                                                                                          52844ef8726b5a4a32421a488a40ece174ab5852490a1f2e252806547c2c43b6

                                                                                                                                          SHA512

                                                                                                                                          f71daa5c5d7c328e60da8f56595a27ebde06008af1868066c822d7268c53b68f8c7060b1906f099fb61e04d771f88e788ca269820a9979f67e35187e88740295

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                                          Filesize

                                                                                                                                          1.7MB

                                                                                                                                          MD5

                                                                                                                                          8fe1f5487a48402213be82f84d976a5d

                                                                                                                                          SHA1

                                                                                                                                          98773b582bb7430c57866329adf17866e6b7d2db

                                                                                                                                          SHA256

                                                                                                                                          637039754dd7d88e4dbb038ffdd4577dac00ff6587182d60b7ab9e77c3c42e76

                                                                                                                                          SHA512

                                                                                                                                          d33984a498e9f7ec76cd8d42076f3f77655d4f2dd09cb89a9d408f2d42581f0ca783be9bb8af64653ae26b89d48942e81671af3c5e7f73f69234091245b31f2f

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\System32\wbengine.exe
                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          MD5

                                                                                                                                          008a8bf5de5d9d1bfe5e43902e4fe88e

                                                                                                                                          SHA1

                                                                                                                                          581b9bdf486ebd830262b2806de9a9e552fce701

                                                                                                                                          SHA256

                                                                                                                                          5d06fdceb0c325341400377389e7ede41a82def42b30757ec293a71c43bb0067

                                                                                                                                          SHA512

                                                                                                                                          5bae19c275916a1da8b2f7491d3e7ff48985ce77ff7a1678e5c2431cf4b1c7db745482bb88ca13b8be10e7f54a303a7f3b0b222c5c0f95bc7bf907f9c6772f15

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Temp\CabED4C.tmp
                                                                                                                                          Filesize

                                                                                                                                          29KB

                                                                                                                                          MD5

                                                                                                                                          d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                          SHA1

                                                                                                                                          e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                          SHA256

                                                                                                                                          a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                          SHA512

                                                                                                                                          17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\Temp\Tar14CA.tmp
                                                                                                                                          Filesize

                                                                                                                                          81KB

                                                                                                                                          MD5

                                                                                                                                          b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                          SHA1

                                                                                                                                          7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                          SHA256

                                                                                                                                          725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                          SHA512

                                                                                                                                          f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          105KB

                                                                                                                                          MD5

                                                                                                                                          d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                          SHA1

                                                                                                                                          9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                          SHA256

                                                                                                                                          dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                          SHA512

                                                                                                                                          5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          248KB

                                                                                                                                          MD5

                                                                                                                                          4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                          SHA1

                                                                                                                                          f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                          SHA256

                                                                                                                                          c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                          SHA512

                                                                                                                                          c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          1.0MB

                                                                                                                                          MD5

                                                                                                                                          598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                          SHA1

                                                                                                                                          5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                          SHA256

                                                                                                                                          e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                          SHA512

                                                                                                                                          774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          58KB

                                                                                                                                          MD5

                                                                                                                                          3d6987fc36386537669f2450761cdd9d

                                                                                                                                          SHA1

                                                                                                                                          7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                          SHA256

                                                                                                                                          34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                          SHA512

                                                                                                                                          1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          205KB

                                                                                                                                          MD5

                                                                                                                                          0a41e63195a60814fe770be368b4992f

                                                                                                                                          SHA1

                                                                                                                                          d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                          SHA256

                                                                                                                                          4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                          SHA512

                                                                                                                                          1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          43KB

                                                                                                                                          MD5

                                                                                                                                          68c51bcdc03e97a119431061273f045a

                                                                                                                                          SHA1

                                                                                                                                          6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                          SHA256

                                                                                                                                          4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                          SHA512

                                                                                                                                          d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          198KB

                                                                                                                                          MD5

                                                                                                                                          9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                          SHA1

                                                                                                                                          ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                          SHA256

                                                                                                                                          469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                          SHA512

                                                                                                                                          58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\57d7950e811a62a6b681bb116623fc4b\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          271KB

                                                                                                                                          MD5

                                                                                                                                          1f07bec6aac1055291177265b8dcc135

                                                                                                                                          SHA1

                                                                                                                                          78df4ab93f2108b57774bea29e6efb32a2c60788

                                                                                                                                          SHA256

                                                                                                                                          b79aa234490ae849d9d17642bb63d69675519931b5b6ac294a2885ffe449353c

                                                                                                                                          SHA512

                                                                                                                                          c1172ff7eab0dd71111bbc6e2a30be8d805409e6f3aa33cb5b4b3b2e6f1d35335a5f8227bf3e19d10b750eeebeafe63690b2a1070a20b8070b8a07dd573e4717

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          70KB

                                                                                                                                          MD5

                                                                                                                                          57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                          SHA1

                                                                                                                                          da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                          SHA256

                                                                                                                                          1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                          SHA512

                                                                                                                                          1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          87KB

                                                                                                                                          MD5

                                                                                                                                          ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                          SHA1

                                                                                                                                          4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                          SHA256

                                                                                                                                          b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                          SHA512

                                                                                                                                          d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9c9e8a3d578d619afb519040c977f5c6\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          305KB

                                                                                                                                          MD5

                                                                                                                                          df891df44cb162580dec4e7df12a741f

                                                                                                                                          SHA1

                                                                                                                                          b18bff99b3ab93872455daeb757cffe686b543f9

                                                                                                                                          SHA256

                                                                                                                                          84b5c1a2b87a7b0b3616b8312ed1246066a6ce570e148ccf5482dce51a4caff6

                                                                                                                                          SHA512

                                                                                                                                          46cbcadd43889d983eb024a6b4ecc36894a6ea1bea12009f4b65ab06a5bb97df845ad268d131766f107da12212cb426f4db99200e206939b976a4271182c8a6c

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          82KB

                                                                                                                                          MD5

                                                                                                                                          2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                          SHA1

                                                                                                                                          66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                          SHA256

                                                                                                                                          37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                          SHA512

                                                                                                                                          cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          58KB

                                                                                                                                          MD5

                                                                                                                                          a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                          SHA1

                                                                                                                                          500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                          SHA256

                                                                                                                                          1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                          SHA512

                                                                                                                                          b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          85KB

                                                                                                                                          MD5

                                                                                                                                          5180107f98e16bdca63e67e7e3169d22

                                                                                                                                          SHA1

                                                                                                                                          dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                          SHA256

                                                                                                                                          d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                          SHA512

                                                                                                                                          27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\c52a5fbe4413dc092efe465c349ff54f\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          221KB

                                                                                                                                          MD5

                                                                                                                                          e214f991560095f7d103a739fe4de37c

                                                                                                                                          SHA1

                                                                                                                                          2cf1c21d0911ea1840edde1d3f43ad8ffd14e153

                                                                                                                                          SHA256

                                                                                                                                          553c8c016b3f7e5fd7f6c06c516c6602a719e2fcc7cbd66fa17386da29ef68b2

                                                                                                                                          SHA512

                                                                                                                                          e368057edee04ba518c110f08b48f4d9a045152b4eaba101d45bce521da488885e3ecb55f2abbe5146031c848e8929199b58c201a8687cae215bfb3510fa01be

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          298KB

                                                                                                                                          MD5

                                                                                                                                          5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                          SHA1

                                                                                                                                          1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                          SHA256

                                                                                                                                          5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                          SHA512

                                                                                                                                          58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\e4ecb533038cd15043f6eba0a5dcfacd\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          122KB

                                                                                                                                          MD5

                                                                                                                                          dd5a9ca0b22f6ac3f57cb06a9bf4bcdd

                                                                                                                                          SHA1

                                                                                                                                          f9f908336087b0a55bb2d1bb677b1a924db442a4

                                                                                                                                          SHA256

                                                                                                                                          896dba564af6c3db22bf2b790724d2b6bf9a4b3562eb127213033d7ca84dc176

                                                                                                                                          SHA512

                                                                                                                                          b35ffee8dd32c4a3757f97a605560075acdb799c201e4e38e090082054ea2589508196de0bdc4bd87f38d614f20d722382d7a99af152a82f88aa63942c193fd0

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          43KB

                                                                                                                                          MD5

                                                                                                                                          dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                          SHA1

                                                                                                                                          d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                          SHA256

                                                                                                                                          f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                          SHA512

                                                                                                                                          8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          124KB

                                                                                                                                          MD5

                                                                                                                                          929653b5b019b4555b25d55e6bf9987b

                                                                                                                                          SHA1

                                                                                                                                          993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                          SHA256

                                                                                                                                          2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                          SHA512

                                                                                                                                          effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          MD5

                                                                                                                                          10b5a285eafccdd35390bb49861657e7

                                                                                                                                          SHA1

                                                                                                                                          62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                          SHA256

                                                                                                                                          5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                          SHA512

                                                                                                                                          19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                          Filesize

                                                                                                                                          88KB

                                                                                                                                          MD5

                                                                                                                                          1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                          SHA1

                                                                                                                                          4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                          SHA256

                                                                                                                                          9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                          SHA512

                                                                                                                                          e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          b634237d628e60e673bbebc3b506ec9e

                                                                                                                                          SHA1

                                                                                                                                          7be2e6bab15d0bbeda3803bf4009617150661fc8

                                                                                                                                          SHA256

                                                                                                                                          52ed4faaf23c95e501e7158c537ba05e96b6855be4c0227bb80aa46df8eaab9d

                                                                                                                                          SHA512

                                                                                                                                          28c57a5722f74be9c96f63da5b34be777226100cf107b677c58ca127da0e0ef8b95bc5316a6be0562ff1111cce71f37e83586b662fac3eb4c3786252f1bd3c8f

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\System32\alg.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          2b0a8d4f529f125c55011569f6af378b

                                                                                                                                          SHA1

                                                                                                                                          880c57ff1ea17a3384d777f98da058382e279748

                                                                                                                                          SHA256

                                                                                                                                          525744904f527103c25baa1e1056dcecee1b6a488bdeb718ead2f7c768041025

                                                                                                                                          SHA512

                                                                                                                                          34c8fb17524efbba1a108800489f0a873c09c9280bd840d428913782a2b555fa3ca2864853aa4c22f16bf3009639d7143561354fb407192397c85a4db0c90070

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\System32\msdtc.exe
                                                                                                                                          Filesize

                                                                                                                                          1.4MB

                                                                                                                                          MD5

                                                                                                                                          a74da474eac9660ab198dd77b50acbe6

                                                                                                                                          SHA1

                                                                                                                                          d8882d7c5b224dd3deef1f61483928ac44445343

                                                                                                                                          SHA256

                                                                                                                                          24f9501ac69a00c09fe2432106e6ab2b15ad065ae8b341c5935bba289e4c84ce

                                                                                                                                          SHA512

                                                                                                                                          1bae18b1eb4bacb4f5f579456ba960e9293a0404c47ab7c7ff2092773cb572541f51239bb0cac6d781ae768dbecb834936d8303aad6b057d4f9eb01d4f24c1a3

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\System32\msiexec.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          c78457be65f11d679536a2c38e02e202

                                                                                                                                          SHA1

                                                                                                                                          12ac053a4d2d0326bb10848406c49e04ea5a2cd0

                                                                                                                                          SHA256

                                                                                                                                          75d3eb6f51f8adb4bc98a2e133b0d20971a3c972af1d545d0d4d777d8e0da13a

                                                                                                                                          SHA512

                                                                                                                                          08a50fb13f70610d9e53b86dad493ad2a858cb7ea3eadb61ef2372caab4db8a5b4179c46d27bdbacb29238aff1a45d410fc57e735362a3aa73e5808e87e222ee

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\System32\snmptrap.exe
                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          659cfb8dcca3b3d22a9f3b88f1d1a92e

                                                                                                                                          SHA1

                                                                                                                                          05fc1ad7e2440113042cf98f56dbe4801157c912

                                                                                                                                          SHA256

                                                                                                                                          8600152309cb06290a84519ae38d479a9f1a7a82a08883e9bd16fa04de8d1148

                                                                                                                                          SHA512

                                                                                                                                          72c122035f6aa755024f0cfdbcee679a88203ae8bcd0918df3d96f73fe27e35cb697f5739066afb217bd64b43222ab5b80be7c09fb19fedf9655b556fb3142a3

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                          Filesize

                                                                                                                                          1.4MB

                                                                                                                                          MD5

                                                                                                                                          c71991f4c2880dc862239f9fd3b64c5f

                                                                                                                                          SHA1

                                                                                                                                          cce75868eb310a7d53cb0250362bb10139394139

                                                                                                                                          SHA256

                                                                                                                                          539b14c076d9a159204599d6e8d4089a522bb2b23d0253011f9c9b764e2d54c3

                                                                                                                                          SHA512

                                                                                                                                          d76a0d6b52ad26577a62156e8fa8d69d3b5f6e5dbcff57f5e3197a67b81d0a8719972e08878715976297223dd172bc5b669259f4012bccea9b2b9214b7e4dd4a

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\ehome\ehrecvr.exe
                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          MD5

                                                                                                                                          d88662b2e08b7cd8b48de00975df325e

                                                                                                                                          SHA1

                                                                                                                                          417fd5add8896ee32f066c23d23e4085e9589094

                                                                                                                                          SHA256

                                                                                                                                          87b3aebb5fd85ad5294490a82ff915ddec9538cb8e88b19faaf6b96859af607e

                                                                                                                                          SHA512

                                                                                                                                          08299098fbc03e3d9e9cba2f593f36b77e5f12eee9cfc23a7b195e63d8561f4b29f20783b2bc614bb1b90110f6f13ec9673fe61337fd71893748e86240c43968

                                                                                                                                          Download Submit

                                                                                                                                        • \Windows\ehome\ehsched.exe
                                                                                                                                          Filesize

                                                                                                                                          1.3MB

                                                                                                                                          MD5

                                                                                                                                          ae56c23293440a6df25723dd394ee48d

                                                                                                                                          SHA1

                                                                                                                                          ab352db330b12fc061e586bd28bd79fb527ce28f

                                                                                                                                          SHA256

                                                                                                                                          12e6eba67c1a1322bc95fc991135400c4f0ca943e3fb7d425020624477e62752

                                                                                                                                          SHA512

                                                                                                                                          df6af617c34fe01eb414c2023d6be8a78c66e53f53e0b90c22359404a9df862edd3146773972165d6bd679789a490aa0124e3ce72873c41c3f44c93939570648

                                                                                                                                          Download Submit

                                                                                                                                        • memory/1004-180-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          Download

                                                                                                                                        • memory/1004-108-0x0000000001990000-0x00000000019A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                          Download

                                                                                                                                        • memory/1004-92-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          Download

                                                                                                                                        • memory/1004-90-0x0000000000A60000-0x0000000000AC0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/1004-84-0x0000000000A60000-0x0000000000AC0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/1004-807-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.2MB

                                                                                                                                          Download

                                                                                                                                        • memory/1004-107-0x0000000001980000-0x0000000001990000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                          Download

                                                                                                                                        • memory/1044-668-0x0000000003E90000-0x0000000003F4A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          744KB

                                                                                                                                          Download

                                                                                                                                        • memory/1272-441-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1272-473-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1312-867-0x00000000019E0000-0x0000000001A28000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                          Download

                                                                                                                                        • memory/1312-866-0x00000000019C0000-0x00000000019CC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          48KB

                                                                                                                                          Download

                                                                                                                                        • memory/1312-865-0x0000000001980000-0x000000000198E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                          Download

                                                                                                                                        • memory/1312-868-0x0000000001A30000-0x0000000001A46000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          88KB

                                                                                                                                          Download

                                                                                                                                        • memory/1356-881-0x00000000019A0000-0x00000000019AC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          48KB

                                                                                                                                          Download

                                                                                                                                        • memory/1356-885-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                          Download

                                                                                                                                        • memory/1356-886-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                          Download

                                                                                                                                        • memory/1356-883-0x0000000001BB0000-0x0000000001BC6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          88KB

                                                                                                                                          Download

                                                                                                                                        • memory/1356-880-0x0000000001980000-0x000000000198E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                          Download

                                                                                                                                        • memory/1356-882-0x0000000001B60000-0x0000000001BA8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                          Download

                                                                                                                                        • memory/1432-904-0x0000000001A00000-0x0000000001A18000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          96KB

                                                                                                                                          Download

                                                                                                                                        • memory/1432-905-0x0000000001A60000-0x0000000001A6E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                          Download

                                                                                                                                        • memory/1432-906-0x0000000001AB0000-0x0000000001ACA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          104KB

                                                                                                                                          Download

                                                                                                                                        • memory/1432-907-0x000000001AD80000-0x000000001AD9E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                          Download

                                                                                                                                        • memory/1532-238-0x000000002E000000-0x000000002E20C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1532-173-0x000000002E000000-0x000000002E20C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1540-223-0x0000000100000000-0x000000010021B000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/1540-667-0x0000000100000000-0x000000010021B000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/1552-497-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1552-546-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1592-498-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1592-485-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1612-0-0x0000000000420000-0x0000000000480000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/1612-6-0x0000000000420000-0x0000000000480000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/1612-9-0x0000000140000000-0x0000000140331000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.2MB

                                                                                                                                          Download

                                                                                                                                        • memory/1612-56-0x0000000140000000-0x0000000140331000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.2MB

                                                                                                                                          Download

                                                                                                                                        • memory/1612-54-0x0000000000420000-0x0000000000480000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/1620-207-0x0000000140000000-0x000000014020D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/1620-151-0x0000000140000000-0x000000014020D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/1660-155-0x0000000140000000-0x0000000140221000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/1660-146-0x0000000140000000-0x0000000140221000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/1756-559-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1756-572-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1824-162-0x0000000000730000-0x0000000000939000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1824-159-0x0000000100000000-0x0000000100209000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1824-233-0x0000000000730000-0x0000000000939000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1824-222-0x0000000100000000-0x0000000100209000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1888-399-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1888-282-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/1944-127-0x0000000000260000-0x00000000002C6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                          Download

                                                                                                                                        • memory/1944-134-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          30.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/1944-200-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          30.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/2036-103-0x0000000000250000-0x00000000002B0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/2036-186-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2036-764-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2036-96-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2036-97-0x0000000000250000-0x00000000002B0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/2068-52-0x0000000000230000-0x0000000000296000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                          Download

                                                                                                                                        • memory/2068-45-0x0000000000230000-0x0000000000296000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                          Download

                                                                                                                                        • memory/2068-44-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2068-161-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2072-76-0x0000000010000000-0x00000000101F6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2072-29-0x0000000010000000-0x00000000101F6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2120-549-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2120-545-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2144-544-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/2144-203-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/2268-755-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2268-239-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2396-496-0x0000000100000000-0x000000010026B000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.4MB

                                                                                                                                          Download

                                                                                                                                        • memory/2396-201-0x0000000100000000-0x000000010026B000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.4MB

                                                                                                                                          Download

                                                                                                                                        • memory/2404-761-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/2404-260-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.1MB

                                                                                                                                          Download

                                                                                                                                        • memory/2452-196-0x0000000100000000-0x00000001001ED000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.9MB

                                                                                                                                          Download

                                                                                                                                        • memory/2452-484-0x0000000100000000-0x00000001001ED000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.9MB

                                                                                                                                          Download

                                                                                                                                        • memory/2484-948-0x000000001A4D0000-0x000000001A4DC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          48KB

                                                                                                                                          Download

                                                                                                                                        • memory/2484-949-0x000000001AD60000-0x000000001AD70000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                          Download

                                                                                                                                        • memory/2500-80-0x0000000010000000-0x00000000101FE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2500-36-0x0000000010000000-0x00000000101FE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2536-208-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2536-558-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2568-24-0x00000000007F0000-0x0000000000850000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/2568-17-0x0000000140000000-0x00000001401F4000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2568-126-0x0000000140000000-0x00000001401F4000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2568-18-0x00000000007F0000-0x0000000000850000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/2588-122-0x0000000100000000-0x00000001001FB000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2588-13-0x0000000100000000-0x00000001001FB000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2596-440-0x0000000100000000-0x00000001001EC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.9MB

                                                                                                                                          Download

                                                                                                                                        • memory/2596-192-0x0000000100000000-0x00000001001EC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.9MB

                                                                                                                                          Download

                                                                                                                                        • memory/2700-165-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2700-71-0x0000000000AD0000-0x0000000000B30000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/2700-64-0x0000000000AD0000-0x0000000000B30000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/2700-69-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2760-251-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.3MB

                                                                                                                                          Download

                                                                                                                                        • memory/2760-181-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.3MB

                                                                                                                                          Download

                                                                                                                                        • memory/2844-785-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2844-123-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2844-195-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2904-234-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2904-322-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.0MB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-923-0x0000000001BB0000-0x0000000001BCA000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          104KB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-920-0x0000000001B80000-0x0000000001B8E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          56KB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-921-0x0000000001B90000-0x0000000001BA6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          88KB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-922-0x000000001AE40000-0x000000001AE88000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          288KB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-930-0x000000001B6B0000-0x000000001B6C8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          96KB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-919-0x0000000001980000-0x0000000001998000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          96KB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-924-0x000000001B360000-0x000000001B37E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                          Download

                                                                                                                                        • memory/2936-929-0x000000001B6B0000-0x000000001B6C8000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          96KB

                                                                                                                                          Download

                                                                                                                                        • memory/3004-189-0x0000000001000000-0x00000000011ED000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.9MB

                                                                                                                                          Download

                                                                                                                                        • memory/3012-116-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/3012-110-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          384KB

                                                                                                                                          Download

                                                                                                                                        • memory/3012-190-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.2MB

                                                                                                                                          Download

                                                                                                                                        • memory/3012-118-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          2.2MB

                                                                                                                                          Download