Overview

overview

7

Static

static

3

2024-06-28...re.exe

windows7-x64

7

2024-06-28...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28-06-2024 09:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-28_98b82e58d9cd48f345b1508842b60ef0_bkransomware.exe

  • Size

    1.3MB

  • MD5

    98b82e58d9cd48f345b1508842b60ef0

  • SHA1

    89c8b521879dd3c69071f81c038ac664a08aba49

  • SHA256

    fa26685234397c8fe902d3473b4dc05f8b40b1b482513b44b95af041a279d9fa

  • SHA512

    b8b7da9506432058623fdd0e69a540881d67c2a3144db2d81aa3b0f706a03e92a15ab371fd953f811a18ca5e843c32b6f16db006528220d3127a7b1b34c897bc

  • SSDEEP

    12288:CtOw6BaIMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:86BKSkQ/7Gb8NLEbeZ

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 57 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-28_98b82e58d9cd48f345b1508842b60ef0_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-28_98b82e58d9cd48f345b1508842b60ef0_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2084
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2620
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2608
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2748
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2332
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2448
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 1ec -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1dc -NGENProcess 25c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1444
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 23c -NGENProcess 260 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1e4 -NGENProcess 25c -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2308
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 238 -NGENProcess 268 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 250 -NGENProcess 25c -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 26c -NGENProcess 1e4 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1712
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 268 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1436
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 250 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2836
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1dc -NGENProcess 268 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 268 -NGENProcess 25c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 260 -NGENProcess 27c -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 288 -NGENProcess 250 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1508
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1e4 -NGENProcess 278 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2988
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 268 -NGENProcess 274 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2308
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 28c -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 294 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1688
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 274 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 270 -NGENProcess 2a0 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2716
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 288 -NGENProcess 274 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2804
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 29c -NGENProcess 2a8 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2416
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2528
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2388
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1e0 -NGENProcess 204 -Pipe 1b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1396
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 258 -NGENProcess 234 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1624
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3000
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1e0 -NGENProcess 264 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3024
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 22c -NGENProcess 248 -Pipe 1ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2044
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 248 -NGENProcess 260 -Pipe 234 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2416
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 270 -NGENProcess 22c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2128
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 22c -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1800
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 278 -NGENProcess 260 -Pipe 204 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2716
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1792
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 280 -NGENProcess 268 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1912
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 260 -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3068
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 26c -NGENProcess 268 -Pipe 22c -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2996
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 260 -NGENProcess 284 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
        PID:1028
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 23c -NGENProcess 28c -Pipe 27c -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2716
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 260 -NGENProcess 298 -Pipe 26c -Comment "NGen Worker Process"
        2⤵
          PID:1792
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 270 -NGENProcess 28c -Pipe 264 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2436
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 28c -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
          2⤵
            PID:2500
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2a0 -NGENProcess 298 -Pipe 268 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1460
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 28c -NGENProcess 29c -Pipe 288 -Comment "NGen Worker Process"
            2⤵
              PID:2104
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 23c -NGENProcess 2a4 -Pipe 260 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2388
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 2a4 -NGENProcess 2a0 -Pipe 298 -Comment "NGen Worker Process"
              2⤵
                PID:768
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2b0 -NGENProcess 29c -Pipe 270 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:592
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 23c -NGENProcess 2b8 -Pipe 2a4 -Comment "NGen Worker Process"
                2⤵
                  PID:2276
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 2a8 -NGENProcess 29c -Pipe 28c -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2740
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 23c -NGENProcess 2c0 -Pipe 2b4 -Comment "NGen Worker Process"
                  2⤵
                    PID:264
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 290 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2832
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2c8 -Pipe 23c -Comment "NGen Worker Process"
                    2⤵
                      PID:2488
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2a0 -NGENProcess 29c -Pipe 2b0 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2128
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 29c -NGENProcess 2c4 -Pipe 290 -Comment "NGen Worker Process"
                      2⤵
                        PID:2284
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2d0 -NGENProcess 2c8 -Pipe 2bc -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:2144
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c8 -NGENProcess 2a0 -Pipe 2cc -Comment "NGen Worker Process"
                        2⤵
                          PID:2836
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2d8 -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2708
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c4 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
                          2⤵
                            PID:1444
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e0 -NGENProcess 2a0 -Pipe 29c -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:636
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2a0 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
                            2⤵
                            • Modifies data under HKEY_USERS
                            PID:2500
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2c8 -Comment "NGen Worker Process"
                            2⤵
                              PID:1636
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2e4 -Pipe 2b8 -Comment "NGen Worker Process"
                              2⤵
                                PID:1120
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2c4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:3000
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2d0 -Pipe 2a8 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1964
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2e4 -Pipe 2e0 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2972
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e4 -NGENProcess 2f0 -Pipe 2d8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1068
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2f0 -NGENProcess 2a0 -Pipe 2d0 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1476
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 304 -NGENProcess 2fc -Pipe 2ec -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:1396
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 300 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1392
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 30c -NGENProcess 2a0 -Pipe 2f8 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2728
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 308 -Pipe 2e8 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1712
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2e4 -Pipe 2f0 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1692
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2a0 -Pipe 2f4 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:3004
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 308 -Pipe 304 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2584
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2e4 -Pipe 2fc -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1380
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2a0 -Pipe 30c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1636
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 308 -Pipe 310 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:448
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2e4 -Pipe 314 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:380
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2a0 -Pipe 318 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2716
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1652
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2e4 -Pipe 320 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:756
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2a0 -Pipe 324 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2220
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 308 -Pipe 328 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:960
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 348 -NGENProcess 2e4 -Pipe 334 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:1828
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 32c -NGENProcess 344 -Pipe 330 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1780
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 34c -NGENProcess 308 -Pipe 2c0 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2276
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2e4 -Pipe 338 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2972
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 344 -Pipe 33c -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2280
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 308 -Pipe 340 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1820
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2e4 -Pipe 348 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2328
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 344 -Pipe 32c -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1380
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 308 -Pipe 34c -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    PID:1656
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 308 -NGENProcess 35c -Pipe 2e4 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:1780
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 36c -NGENProcess 344 -Pipe 354 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2276
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 368 -Pipe 358 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2972
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 35c -Pipe 360 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2836
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 344 -Pipe 350 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2660
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 370 -Pipe 36c -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:3056
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 364 -NGENProcess 344 -Pipe 308 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:112
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 384 -NGENProcess 374 -Pipe 2a0 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1580
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 370 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:1320
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 344 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1956
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 374 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:1336
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 370 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:1872
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 344 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:264
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 374 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:1512
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 370 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2976
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 344 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2968
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 374 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2748
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3a0 -NGENProcess 3b0 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2280
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 394 -NGENProcess 374 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2272
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b4 -NGENProcess 3a8 -Pipe 35c -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2788
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 3b0 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2660
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 394 -NGENProcess 3c0 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:3008
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 370 -NGENProcess 3b0 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:2436
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 3c4 -NGENProcess 3b8 -Pipe 344 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:636
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3c0 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2160
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3b0 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1384
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3b8 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:3000
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3c0 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2896
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3b0 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:264
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3b8 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2384
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 3c0 -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2500
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 3cc -Pipe 108 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2312
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3d4 -NGENProcess 3e4 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2196
                                                                                                                                          • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1512
                                                                                                                                          • C:\Windows\ehome\ehsched.exe
                                                                                                                                            C:\Windows\ehome\ehsched.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3028
                                                                                                                                          • C:\Windows\eHome\EhTray.exe
                                                                                                                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:536
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:600
                                                                                                                                          • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                            C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1088
                                                                                                                                          • C:\Windows\ehome\ehRec.exe
                                                                                                                                            C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1188
                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                            "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:992
                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:624
                                                                                                                                          • C:\Windows\System32\msdtc.exe
                                                                                                                                            C:\Windows\System32\msdtc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:1432
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:908
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2772
                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2492
                                                                                                                                          • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2592
                                                                                                                                          • C:\Windows\system32\locator.exe
                                                                                                                                            C:\Windows\system32\locator.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2544
                                                                                                                                          • C:\Windows\System32\snmptrap.exe
                                                                                                                                            C:\Windows\System32\snmptrap.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2136
                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1888
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2072
                                                                                                                                          • C:\Windows\system32\wbengine.exe
                                                                                                                                            "C:\Windows\system32\wbengine.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2100
                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1916
                                                                                                                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                            "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1524
                                                                                                                                          • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:2808
                                                                                                                                            • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:2252
                                                                                                                                            • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                              "C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1644
                                                                                                                                          • C:\Windows\system32\dllhost.exe
                                                                                                                                            C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:344

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            MD5

                                                                                                                                            fa6132c27c5405a66a0f28f39d1a2a23

                                                                                                                                            SHA1

                                                                                                                                            2275f26538c28974048c560862b308706104867f

                                                                                                                                            SHA256

                                                                                                                                            e9347a2644ef375047c2df1cc69abe8f75d93a7a846a9f638a6866aa932d5b37

                                                                                                                                            SHA512

                                                                                                                                            9db9aa81fb0485f9095c7859a7c5129bb2cbbf04e10ba7d3a72817b83be71f3bf1cfbd131468accc71a3c38d55206951e0d25317171c0525a5e649da35ace28d

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                            MD5

                                                                                                                                            8bb9236dd44e34ed8fac834547733364

                                                                                                                                            SHA1

                                                                                                                                            d2a8261ecc7ea253559f9ea8192b7c70a9a80389

                                                                                                                                            SHA256

                                                                                                                                            28c03cc290b45bb041ff7dae03dd9c9796745c963237546bf40c3b0f41941185

                                                                                                                                            SHA512

                                                                                                                                            a42e74e75e3e94b234773c3f2fdbc617079e43e52459ce37b05d6a9f2d8d1b411c04eb2a886547a00a023ae7a85c0cd6d239ab2cc898aa807c1f7dd1546c9bbf

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                            Filesize

                                                                                                                                            1.4MB

                                                                                                                                            MD5

                                                                                                                                            1f76e18fc12531a9f4911bf2f98806a6

                                                                                                                                            SHA1

                                                                                                                                            acda3f4ff3f1e1940adcf4c816813f6578894a05

                                                                                                                                            SHA256

                                                                                                                                            10d0118b397fdafa78337f54e4a751e7df2e2dddc7d15619c2ee1208eb0d27b8

                                                                                                                                            SHA512

                                                                                                                                            3f5312dd2ed6275f175d5411458a789837b066e677d18e5ebf7008ea09c722659aa43517f0c20af694ae44a1fa4d7253562b037ebcda161122244bcc94b3e019

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                            Filesize

                                                                                                                                            5.2MB

                                                                                                                                            MD5

                                                                                                                                            abdeb200f1597cf0e434469957b82d40

                                                                                                                                            SHA1

                                                                                                                                            5d2d429210171d264adda88b6502806374a95939

                                                                                                                                            SHA256

                                                                                                                                            053b32901a2ca22d05b9a9f976b9a372258dea95f0a45acdede6c4d224d0a944

                                                                                                                                            SHA512

                                                                                                                                            80875a7065543e3833910667e2d8ed4c4d902bae830aa4d7274e95ca257cdddd51cae261d871a5ed3796b82f774ce9cd5ddc4079b7e31816ffd459fe241fcd86

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            77510bd4a53228490312eb6ac30b1a6f

                                                                                                                                            SHA1

                                                                                                                                            4d7c72a5d320cf8d2e82d18f0191e890d75e0e88

                                                                                                                                            SHA256

                                                                                                                                            b626c7e1c122f8b69815464b5459f22af57ecaf9771a93b07b7e4ed10da5484a

                                                                                                                                            SHA512

                                                                                                                                            75009af1f4838347bfc0e428c3fbf4ae30d6fdf81f10afa7c7e26f76bcc9c55babfd93d02ff7ec7a9474db4b071d2357333dd9301a6c9e9fb381eb66d91f3fcc

                                                                                                                                            Download Submit

                                                                                                                                          • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            MD5

                                                                                                                                            7655a71129c86eaa0ed0888804c6c767

                                                                                                                                            SHA1

                                                                                                                                            dc466e30a2185269f8f9cf6bbb503295874e02b7

                                                                                                                                            SHA256

                                                                                                                                            87ab1f1c9b876082959b590e542e3559241c2142493ac88330e30547b22df759

                                                                                                                                            SHA512

                                                                                                                                            52ba427b6748b42092a47b0458de46e9981455ad24abb63b36a6889e09e72f192aa4494030c998875fc0c4026326a3b68289f070b914c350e9e38e8a2cb47b3a

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                            Filesize

                                                                                                                                            24B

                                                                                                                                            MD5

                                                                                                                                            b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                            SHA1

                                                                                                                                            9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                            SHA256

                                                                                                                                            7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                            SHA512

                                                                                                                                            cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            a6ed83dfb968fdef381369b090072cb7

                                                                                                                                            SHA1

                                                                                                                                            3684f28d1d84b02f1efb3654313cab2df01a6626

                                                                                                                                            SHA256

                                                                                                                                            8af07d369fc1613af7cb1a7d4899b912cb9d0eb2cb219ced2265c38704e9d23c

                                                                                                                                            SHA512

                                                                                                                                            3ba73584f90fc8e50aa9d4c861d4ec36f8ff67af01500879b095e02fabe1cc2862e532e7e9079c8224e1a83eb7edfabd22be4c1dfee82c83d0007de877b6ae9c

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                            Filesize

                                                                                                                                            872KB

                                                                                                                                            MD5

                                                                                                                                            39932a379bcfd351e49ce99023d4244c

                                                                                                                                            SHA1

                                                                                                                                            c7b53baae25f69138bc4206259470b36ac263a40

                                                                                                                                            SHA256

                                                                                                                                            bd68df564a79dfe4709fba7086f42589c511940155f4839f6c0746391fccd01b

                                                                                                                                            SHA512

                                                                                                                                            87342de2a3cf7297c1c364883783edbb78e0f7b6f05bb5b23e8c4bc2119c62b46028bfb7a640d8c53fbd45864c71244f1ba19d0772c22702c5613ec8353d0730

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            MD5

                                                                                                                                            7d4d43b91248f27a6d144170a5899def

                                                                                                                                            SHA1

                                                                                                                                            c56ed271f3126bfa4a797b6ac1282021a0ee2647

                                                                                                                                            SHA256

                                                                                                                                            6f06a7921e3ef550781032cc8bfef09960404b3f11fe83a56c1adcff416845bf

                                                                                                                                            SHA512

                                                                                                                                            d53bff47af6671f2c7a00a5933f5842b284e558a98c1d6ac43dca730662bf170c0b210f29b6726b87be0e91831188a967a6bb939032fd960bc9977a7545f6f60

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            3469a6514e49c7008ca5f614a6517e85

                                                                                                                                            SHA1

                                                                                                                                            8d56c3af3a76c30cf03b95e1c4f3f15f69279b54

                                                                                                                                            SHA256

                                                                                                                                            c4004ee1765b77ca040d386bb4f9992a753af737d605b56e13be462e02d4fcd7

                                                                                                                                            SHA512

                                                                                                                                            f09c10f85286dbd7b43a96be2038b1ef96b040c1ca44aa130c208c60f5d8c16b2b0816daf99651200f11c6a4e7241881b1e5bcd2f154aaab71d033b97b01ea26

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            e0f5818267792577f0b564c3d98a6c33

                                                                                                                                            SHA1

                                                                                                                                            a6911f51ae8d5c191693fd7879e3d6c7e8878e50

                                                                                                                                            SHA256

                                                                                                                                            9d4b342ed62f6b70895077c82936c60fbb390e8f8b9a92d6807bbec0e902a858

                                                                                                                                            SHA512

                                                                                                                                            17454efa27f4bcd5d8686008aaa0b0733b382f1de3f99dec0c8f79286c456913e361b09c171f48b8273dc4b279400791f6e272163e63af57181b6f2c26ae2933

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                            Filesize

                                                                                                                                            1003KB

                                                                                                                                            MD5

                                                                                                                                            6bf8f47b9daf113241a99f5c91c86a4d

                                                                                                                                            SHA1

                                                                                                                                            dc098add86ceefa2983b9948b5bedcd6719e02ae

                                                                                                                                            SHA256

                                                                                                                                            ddf04b3a741a3f0ae3db5f2aba41c41998e2f657a97761ca39469700b1f7acc3

                                                                                                                                            SHA512

                                                                                                                                            c3682c941daa5100ba8b5620f49c397da76ba6aa15b163166cb4ccc19300fcb65d6943c80a11e19014cdde1125ab1b96db81b19b2a300eca459cd2488183c544

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            724d7e4594a95be598a07e676c6959ad

                                                                                                                                            SHA1

                                                                                                                                            6968f66954aff442977c5d3e05bb26f4e4ed22b2

                                                                                                                                            SHA256

                                                                                                                                            facca327c528f7faf0773e9c647996175802475934fb8048ea66409962054d06

                                                                                                                                            SHA512

                                                                                                                                            4d901504b61239661f766b90011e9c204c29695829e7fd247d66694d0790a4bafe62f6a9e207b53cb7007d753ca2bb5df1fa59f6fd529b9ae96ddb76d3c774a8

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            e1a6a783788e42ff4758fea8ea89223a

                                                                                                                                            SHA1

                                                                                                                                            ef0b9348550e570742d1883f142eb06853481540

                                                                                                                                            SHA256

                                                                                                                                            5d261a17b11c7ec5873d924b74e8f46108218c5b6d3f2bc8f046eef0798f147d

                                                                                                                                            SHA512

                                                                                                                                            2c7c71cacfe7544f5bdaf0076e9f8aa5f6c8b6d9680b3bf5475b1704ecd571c92c55ce17188a0c5a977e0b85d96e724165b74d79de4cfafa9965be039bd03148

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\System32\SearchIndexer.exe
                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                            MD5

                                                                                                                                            7bd001c275e1f7117f45aa2c8612ad29

                                                                                                                                            SHA1

                                                                                                                                            3604efd6207300413292b3e62a9f12a61d973ba7

                                                                                                                                            SHA256

                                                                                                                                            45bfeadfa514657d05728aabe63c8b21fd28d1bea6fd3ccc025014f8e15d2c9c

                                                                                                                                            SHA512

                                                                                                                                            0e88d9d8f1f5552b905682e7e5fb6d55831e7fded60d5acd9365da2c3ed54cd7edb4454a1d339b313a7d56575f6df73cc153b792126ac72199c1e23aa31ae7e6

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\System32\VSSVC.exe
                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            ef632a123be8686a117af16e55442876

                                                                                                                                            SHA1

                                                                                                                                            b56ff5ab557162f2e6b011bdb706768bd3b4f52b

                                                                                                                                            SHA256

                                                                                                                                            cc545268bba651f5c289be0756c8c0b100fcade8b959b847eb42597b6a0e3738

                                                                                                                                            SHA512

                                                                                                                                            d56d147f3f7faa558fd7552b456d495d2a74453c9563a813f979787d23dddb9a7dceb4a1c125217140a095165b58530ffc89d498bdc3b14b80c4ba543b3c8aa6

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\System32\msiexec.exe
                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            MD5

                                                                                                                                            397221c86109503b847c0515b7906b04

                                                                                                                                            SHA1

                                                                                                                                            72938adf8cff2886de3310dadc27fa7a2e43daef

                                                                                                                                            SHA256

                                                                                                                                            86098924d56d8a013a915f7d1068e16b940d18841cdaa05572afb988d6efa1a4

                                                                                                                                            SHA512

                                                                                                                                            5e2875987fc11eeaa6a523e5e6b186df65911b01eb065b45809b3f6f24719b86df0240c81dabdca3510e96fc06156f5b12fc5d6cfefe5427b5527f26130f4b57

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\System32\snmptrap.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            cc20b06af6f20bdea7eb798868980ed0

                                                                                                                                            SHA1

                                                                                                                                            2a7a513062955fc1ef341b615f3cf12e0925f1eb

                                                                                                                                            SHA256

                                                                                                                                            8ba90f140e5d1ac2bddc1c5551ee2aa9591f262c64d109373d562913f1f64ef7

                                                                                                                                            SHA512

                                                                                                                                            5f5916c822df79f26ba7c8e8c7df6354911a9c49449738a7a5cd8fb6fc5ecb881fe36411ef1376dc8e43312a6900c52b5bc88e2b60210b0072c087923e6be0a4

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                            Filesize

                                                                                                                                            1.7MB

                                                                                                                                            MD5

                                                                                                                                            725a7c3fb5cdbff52996391c5455fed3

                                                                                                                                            SHA1

                                                                                                                                            ffbc0bf0b498b605adffd70b21f4314007a9a144

                                                                                                                                            SHA256

                                                                                                                                            5d0680efc3db7e3a69badc5d1c1211bf80a21c1ae41d2e2d95c5ded440794937

                                                                                                                                            SHA512

                                                                                                                                            b49623f03fcb602e087340e66f75e73d290519ccec60c4a95819b564816e1ac1828c4b37353aefb1845299c04d2d6c58499de63aed1efc515130f45105408333

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            MD5

                                                                                                                                            e91b5d15dc4cd1c2c48afc06b68901e7

                                                                                                                                            SHA1

                                                                                                                                            5f3d6e3667b1a3628bbb097327bdb35e20be9fbe

                                                                                                                                            SHA256

                                                                                                                                            2fa5744500d75b8d036e0dd48da94f8a95bdbaf834929561fc01b5d124cc1297

                                                                                                                                            SHA512

                                                                                                                                            fe6dea95c4e99742132e86f17768b5fc36c2a6a29a96c3d19a1131b291eab2d3ff4d7d44113fd0ae8d36477ab094ee5b2206fc96cfa623f184ca2f86688050bd

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Temp\CabF612.tmp
                                                                                                                                            Filesize

                                                                                                                                            29KB

                                                                                                                                            MD5

                                                                                                                                            d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                            SHA1

                                                                                                                                            e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                            SHA256

                                                                                                                                            a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                            SHA512

                                                                                                                                            17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\Temp\Tar1D91.tmp
                                                                                                                                            Filesize

                                                                                                                                            81KB

                                                                                                                                            MD5

                                                                                                                                            b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                            SHA1

                                                                                                                                            7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                            SHA256

                                                                                                                                            725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                            SHA512

                                                                                                                                            f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            105KB

                                                                                                                                            MD5

                                                                                                                                            d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                            SHA1

                                                                                                                                            9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                            SHA256

                                                                                                                                            dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                            SHA512

                                                                                                                                            5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            248KB

                                                                                                                                            MD5

                                                                                                                                            4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                            SHA1

                                                                                                                                            f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                            SHA256

                                                                                                                                            c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                            SHA512

                                                                                                                                            c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                            MD5

                                                                                                                                            598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                            SHA1

                                                                                                                                            5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                            SHA256

                                                                                                                                            e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                            SHA512

                                                                                                                                            774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            58KB

                                                                                                                                            MD5

                                                                                                                                            3d6987fc36386537669f2450761cdd9d

                                                                                                                                            SHA1

                                                                                                                                            7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                            SHA256

                                                                                                                                            34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                            SHA512

                                                                                                                                            1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            205KB

                                                                                                                                            MD5

                                                                                                                                            0a41e63195a60814fe770be368b4992f

                                                                                                                                            SHA1

                                                                                                                                            d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                            SHA256

                                                                                                                                            4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                            SHA512

                                                                                                                                            1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            43KB

                                                                                                                                            MD5

                                                                                                                                            68c51bcdc03e97a119431061273f045a

                                                                                                                                            SHA1

                                                                                                                                            6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                            SHA256

                                                                                                                                            4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                            SHA512

                                                                                                                                            d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            198KB

                                                                                                                                            MD5

                                                                                                                                            9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                            SHA1

                                                                                                                                            ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                            SHA256

                                                                                                                                            469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                            SHA512

                                                                                                                                            58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            70KB

                                                                                                                                            MD5

                                                                                                                                            57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                            SHA1

                                                                                                                                            da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                            SHA256

                                                                                                                                            1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                            SHA512

                                                                                                                                            1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77ecea7c097681a5922fa588348cffef\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            305KB

                                                                                                                                            MD5

                                                                                                                                            d224b8780a115521653d4b172d3c194d

                                                                                                                                            SHA1

                                                                                                                                            7ddcb931a2f0db38e2f8c1c20761b4e6d80fa6e0

                                                                                                                                            SHA256

                                                                                                                                            822adb4e188240fbc7c6ebaa5abb08873764776a8e7dbfacb3d6b1a50753cfa2

                                                                                                                                            SHA512

                                                                                                                                            98feff67661e6955a73d20a8eb84b5f9e8252148bccb9bbbb0c5b1e8d20789745189bc2ee98fe022678ddbaa5b06ef22522fa37078fa230fc81010314f0bd4a9

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            87KB

                                                                                                                                            MD5

                                                                                                                                            ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                            SHA1

                                                                                                                                            4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                            SHA256

                                                                                                                                            b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                            SHA512

                                                                                                                                            d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\794950515c8505afd89eb8c0e1f05dad\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            271KB

                                                                                                                                            MD5

                                                                                                                                            09f633e2b6e362395b8fd08961c72d8c

                                                                                                                                            SHA1

                                                                                                                                            177e2f69ca11c0111139ee28dab799ce7dded770

                                                                                                                                            SHA256

                                                                                                                                            0302a7d429d5719102c39c253325d3802fa6af9520cc1f268801000ea5c7120b

                                                                                                                                            SHA512

                                                                                                                                            2ce293dbdfe025b37153f70053388711120b66ada4238e760df2e4a2da20bdf5952af2767ad93bedd6827072e8e2259bb331fdf7a2ff5c1796ddae576cc2b64d

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            82KB

                                                                                                                                            MD5

                                                                                                                                            2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                            SHA1

                                                                                                                                            66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                            SHA256

                                                                                                                                            37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                            SHA512

                                                                                                                                            cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a29ab176ee86899ac7d6af65a5c579e8\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            122KB

                                                                                                                                            MD5

                                                                                                                                            84f21db7619bcabba9595c3274835c51

                                                                                                                                            SHA1

                                                                                                                                            8b1c427b992273077c6d47f3c6f6975ae2259058

                                                                                                                                            SHA256

                                                                                                                                            c5a820c913d7d58b3d398a75db37cac4e00f66881e007672fa247e6aa028eb53

                                                                                                                                            SHA512

                                                                                                                                            c4d0f15f889e1e1bdd5aa3a4bcf91c0ce1d947dcbe12e61ea858fca9d262969935fd0d316236cb4934881fbac242eb81b0a9acdd7a95728677e5848907d45003

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            58KB

                                                                                                                                            MD5

                                                                                                                                            a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                            SHA1

                                                                                                                                            500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                            SHA256

                                                                                                                                            1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                            SHA512

                                                                                                                                            b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            85KB

                                                                                                                                            MD5

                                                                                                                                            5180107f98e16bdca63e67e7e3169d22

                                                                                                                                            SHA1

                                                                                                                                            dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                            SHA256

                                                                                                                                            d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                            SHA512

                                                                                                                                            27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d4b0fae4c1646218cd94f0fd549e6703\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            221KB

                                                                                                                                            MD5

                                                                                                                                            32d34b88c15008b36e6dfa63e73694e3

                                                                                                                                            SHA1

                                                                                                                                            f739bff867d816b0a45638a396e47716ee8a43d5

                                                                                                                                            SHA256

                                                                                                                                            74557fc4088e35ce37c9616cf3b0bc2dedd139d7456024d1a6de796b82a408fb

                                                                                                                                            SHA512

                                                                                                                                            624274aaaa5e14c92a825ab0498ea1497e60466c4342bb7d084c231882dceddbc9276dd8796386fd08781493eecf1c265d2d4a379295afc424643a08b5f23391

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            298KB

                                                                                                                                            MD5

                                                                                                                                            5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                            SHA1

                                                                                                                                            1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                            SHA256

                                                                                                                                            5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                            SHA512

                                                                                                                                            58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            43KB

                                                                                                                                            MD5

                                                                                                                                            dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                            SHA1

                                                                                                                                            d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                            SHA256

                                                                                                                                            f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                            SHA512

                                                                                                                                            8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            124KB

                                                                                                                                            MD5

                                                                                                                                            929653b5b019b4555b25d55e6bf9987b

                                                                                                                                            SHA1

                                                                                                                                            993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                            SHA256

                                                                                                                                            2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                            SHA512

                                                                                                                                            effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            MD5

                                                                                                                                            10b5a285eafccdd35390bb49861657e7

                                                                                                                                            SHA1

                                                                                                                                            62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                            SHA256

                                                                                                                                            5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                            SHA512

                                                                                                                                            19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                            Filesize

                                                                                                                                            88KB

                                                                                                                                            MD5

                                                                                                                                            1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                            SHA1

                                                                                                                                            4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                            SHA256

                                                                                                                                            9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                            SHA512

                                                                                                                                            e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                            Download Submit

                                                                                                                                          • \Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                            MD5

                                                                                                                                            9bc5d9416a9daf2c737c0206adb9f32d

                                                                                                                                            SHA1

                                                                                                                                            85904c80d1fabf2f84ddcd37cc4e51746e9245be

                                                                                                                                            SHA256

                                                                                                                                            b583721f4f91549bf0bbb4a248dad5b28529b2b559f830b753c9d1a60c7b7961

                                                                                                                                            SHA512

                                                                                                                                            85eef93efde28808659880ddf27cc645e7f13f93b1392bc83637569160b7c01b9d752871cf7e6fdbabef37e34a6e829910202f1bfdd8768180a342e6ca26fbe6

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            c26f7b42318373b91e80c8cc1c13421f

                                                                                                                                            SHA1

                                                                                                                                            7cccb9dc063889b58e2d0211055c5e9b10a6388d

                                                                                                                                            SHA256

                                                                                                                                            7cbd243e7ba0630b599276b75af74a9cafd85255b030f6d4e9ca7cb2577075d1

                                                                                                                                            SHA512

                                                                                                                                            9514b07962cb888965fa37e79778fd54b50e7ff1badf2d25504b044b7f9429773c7c0f21416413fbc883715b1099da23e903bd162c6fdcb169181905d382c712

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\System32\Locator.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            bfcaf21d3bb4023c7e493a0641f59087

                                                                                                                                            SHA1

                                                                                                                                            1c82d8a0d20009cfd1298b002fbc7e31387bdfcf

                                                                                                                                            SHA256

                                                                                                                                            5ac6460ca922c08394d9beaa560675e23cf49f6466270061dba6551310ca7de7

                                                                                                                                            SHA512

                                                                                                                                            49255684df8e21b1bedb57a5dcf9e2c79a410bc1f13cec497e68ba215ab06b845139002ce49e0f618e042fea807013da87987ada8cad411c707e2a88f41595d2

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\System32\alg.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            299d3725edbdd0536716ea42ad5b564e

                                                                                                                                            SHA1

                                                                                                                                            e6b4dd899f2a53c289feeb8f1e03bf8c8ba3e19f

                                                                                                                                            SHA256

                                                                                                                                            6145423038a1b0e507b4729acdcba173156644b0e79ac129adde7f38958b1f0a

                                                                                                                                            SHA512

                                                                                                                                            885634f2632529ac59f99c6984200706f5f01acf3eb33e6f3eb3ac6bc92fa529ab970222ac4885ffc4a63064ac1f8e2e7ebc555182682f24194b48f791b44ea7

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\System32\ieetwcollector.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            23fdfabd2fde64b392731f707fbb65d6

                                                                                                                                            SHA1

                                                                                                                                            359b6b29a7e7250af11ca36af6bb69f6f790f2d8

                                                                                                                                            SHA256

                                                                                                                                            7c3e444a81b15ba7e85b7f7302b490e9c8f89e18b55fb7ae03fd8de8a702e778

                                                                                                                                            SHA512

                                                                                                                                            3145ebf9d90ac6949af6a15e8d63cd64d758b5d99fb061eea3fe681aee706554b9177f06393d826f3058f6544f2921117b0461e552b2eaf99a3becc90272d56c

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\System32\msdtc.exe
                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            MD5

                                                                                                                                            e778241338e730317b849f99bd04a4ea

                                                                                                                                            SHA1

                                                                                                                                            37cc61ad3bb58ba5f0c180ee8d5ae037780fe33a

                                                                                                                                            SHA256

                                                                                                                                            39738ca76cd67f4d24cd8e7f65e5a3618bbb24d4303ccbd13143839c9f1f58bd

                                                                                                                                            SHA512

                                                                                                                                            381b9f5a464f0539d3d6756f1bae252bdeb832b969d4bf133c6a8c0765454956729d47fb2d770e035a2bd84e07b4c28c09794958376720aaa700ebf441936717

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\System32\wbengine.exe
                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                            MD5

                                                                                                                                            4cde707eb4a4b4930a145ef2d57cbb23

                                                                                                                                            SHA1

                                                                                                                                            5e2b6daf6395b61b26586ca06961ee65dd27d72e

                                                                                                                                            SHA256

                                                                                                                                            e317f54669246cfef81911fc66208f339ab8612458b4a8cdc382bb81d4f2d1c5

                                                                                                                                            SHA512

                                                                                                                                            0600c1716f9fa422e36c0e53054f09133f700c21e258997fee322cf2f10bf5c84f1db6a71944607b4c030f62a8b191b6fdeb3087867290e1f5c1df8720ab99a6

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\ehome\ehrecvr.exe
                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            e711af2fefff91b7bccbb8dc801a687c

                                                                                                                                            SHA1

                                                                                                                                            95a1dec93810cdfc69cdffd7ddc94ad3fc484626

                                                                                                                                            SHA256

                                                                                                                                            36a722eb9db7bd87fee1bb884848d108d0ab35ac31a9987f3f8cf8f95ed7cfdf

                                                                                                                                            SHA512

                                                                                                                                            8f2d8061790dad64b477fb7baf3e6f737f6f9511db1383e727be4aa970b5e510fd6e7808148649bc8997bd41897ecf8911a80ddf06bf58161c455f000f23cb99

                                                                                                                                            Download Submit

                                                                                                                                          • \Windows\ehome\ehsched.exe
                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            MD5

                                                                                                                                            cb1509d1c76b8bc952d0d953baefe4c2

                                                                                                                                            SHA1

                                                                                                                                            4e3c33e990316fb9a435489b917f08906c0368ec

                                                                                                                                            SHA256

                                                                                                                                            9b6148dd66f22fe832d5579c2244c0cb2db0c83708460f786c50e53da4779c50

                                                                                                                                            SHA512

                                                                                                                                            1038dc3391324ce4e9c826197e163e0ea771985fb212285ebbda1086f09045dd3e923ca7b1fdba7618397bca529e2ff06284871aa7b6c774d3bbf3453c15078b

                                                                                                                                            Download Submit

                                                                                                                                          • memory/600-255-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/600-143-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/624-184-0x0000000140000000-0x0000000140161000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.4MB

                                                                                                                                            Download

                                                                                                                                          • memory/624-179-0x0000000140000000-0x0000000140161000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.4MB

                                                                                                                                            Download

                                                                                                                                          • memory/908-325-0x0000000100000000-0x0000000100149000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/908-201-0x0000000100000000-0x0000000100149000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/908-347-0x0000000000570000-0x00000000006B9000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/908-212-0x0000000000570000-0x00000000006B9000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/960-673-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/960-690-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/992-168-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/992-289-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            30.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/1088-156-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/1088-276-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/1432-312-0x0000000140000000-0x000000014014D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/1432-188-0x0000000140000000-0x000000014014D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/1436-743-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1436-738-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1444-651-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1444-671-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1508-799-0x0000000003E00000-0x0000000003EBA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            744KB

                                                                                                                                            Download

                                                                                                                                          • memory/1508-811-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1512-111-0x0000000000A70000-0x0000000000AD0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/1512-117-0x0000000000A70000-0x0000000000AD0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/1512-230-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1512-110-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1524-349-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                            Download

                                                                                                                                          • memory/1524-704-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                            Download

                                                                                                                                          • memory/1616-787-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1616-860-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1616-865-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1688-852-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1712-740-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1888-290-0x0000000100000000-0x00000001001AB000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.7MB

                                                                                                                                            Download

                                                                                                                                          • memory/1888-638-0x0000000100000000-0x00000001001AB000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.7MB

                                                                                                                                            Download

                                                                                                                                          • memory/1892-720-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/1916-687-0x0000000100000000-0x000000010015B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.4MB

                                                                                                                                            Download

                                                                                                                                          • memory/1916-334-0x0000000100000000-0x000000010015B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.4MB

                                                                                                                                            Download

                                                                                                                                          • memory/2072-650-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2072-292-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2084-89-0x0000000000400000-0x000000000061B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2084-8-0x0000000000620000-0x0000000000686000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            408KB

                                                                                                                                            Download

                                                                                                                                          • memory/2084-1-0x0000000000620000-0x0000000000686000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            408KB

                                                                                                                                            Download

                                                                                                                                          • memory/2084-0-0x0000000000400000-0x000000000061B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2092-615-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2092-633-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2100-321-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                            Download

                                                                                                                                          • memory/2100-672-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            2.0MB

                                                                                                                                            Download

                                                                                                                                          • memory/2136-614-0x0000000100000000-0x000000010012D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2136-277-0x0000000100000000-0x000000010012D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2172-217-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2172-97-0x0000000000530000-0x0000000000590000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2172-91-0x0000000000530000-0x0000000000590000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2172-90-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2308-825-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2308-688-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2308-701-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2332-55-0x0000000010000000-0x000000001013E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2332-101-0x0000000010000000-0x000000001013E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2332-56-0x00000000003F0000-0x0000000000450000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2332-62-0x00000000003F0000-0x0000000000450000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2388-586-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2388-489-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2448-578-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2448-619-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2492-239-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2492-365-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2528-499-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2528-354-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2544-264-0x0000000100000000-0x000000010012C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2544-576-0x0000000100000000-0x000000010012C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2588-844-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2592-488-0x0000000001000000-0x000000000112D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2592-252-0x0000000001000000-0x000000000112D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2608-155-0x0000000140000000-0x0000000140134000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2608-27-0x0000000140000000-0x0000000140134000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2608-28-0x0000000000AB0000-0x0000000000B10000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2608-36-0x0000000000AB0000-0x0000000000B10000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2620-130-0x0000000100000000-0x000000010013B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2620-13-0x0000000100000000-0x000000010013B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2620-20-0x0000000000190000-0x00000000001F0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2620-14-0x0000000000190000-0x00000000001F0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2620-21-0x0000000000190000-0x00000000001F0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2652-768-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2652-764-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2728-705-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2728-716-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2748-40-0x0000000000230000-0x0000000000296000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            408KB

                                                                                                                                            Download

                                                                                                                                          • memory/2748-82-0x0000000010000000-0x0000000010136000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2748-39-0x0000000010000000-0x0000000010136000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2748-45-0x0000000000230000-0x0000000000296000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            408KB

                                                                                                                                            Download

                                                                                                                                          • memory/2772-225-0x000000002E000000-0x000000002E14C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2772-353-0x000000002E000000-0x000000002E14C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/2808-721-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2808-374-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2828-70-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2828-211-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2828-76-0x0000000000360000-0x00000000003C6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            408KB

                                                                                                                                            Download

                                                                                                                                          • memory/2828-71-0x0000000000360000-0x00000000003C6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            408KB

                                                                                                                                            Download

                                                                                                                                          • memory/2836-745-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2836-763-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2936-790-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2936-785-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2988-803-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2988-815-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2992-660-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/2992-639-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            Download

                                                                                                                                          • memory/3028-132-0x0000000140000000-0x0000000140149000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/3028-250-0x0000000140000000-0x0000000140149000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/3028-908-0x0000000140000000-0x0000000140149000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download