Overview

overview

7

Static

static

3

20a06d9b6f...b5.exe

windows7-x64

7

20a06d9b6f...b5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 07:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
  • Size 1.4MB
  • Sample240825-hvpjpsshkp
  • SHA256 20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 25 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
    "C:\Users\Admin\AppData\Local\Temp\20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2528
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:520
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2728
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2932
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:1144
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2908
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 25c -NGENProcess 244 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1484
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 24c -NGENProcess 250 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2712
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 24c -NGENProcess 25c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1560
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 254 -NGENProcess 250 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2380
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 268 -NGENProcess 1e4 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2168
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 268 -NGENProcess 254 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2828
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 274 -NGENProcess 1e4 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2412
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 250 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2576
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 268 -NGENProcess 26c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:664
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 254 -NGENProcess 24c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2708
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 24c -NGENProcess 270 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1644
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 27c -NGENProcess 1e4 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:672
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 288 -NGENProcess 248 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1852
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 270 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 1e4 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1380
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 248 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 270 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 290 -NGENProcess 2a0 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 27c -NGENProcess 270 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2a4 -NGENProcess 298 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1596
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2a8 -NGENProcess 2a0 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1712
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2ac -NGENProcess 270 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:320
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2596
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1644
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1f4 -NGENProcess 238 -Pipe 1bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1380
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 25c -NGENProcess 23c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:924
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2896
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 238 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2376
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 23c -Pipe 1b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2608
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 238 -NGENProcess 23c -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2244
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 274 -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2744
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 26c -NGENProcess 268 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:512
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2948
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 23c -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2072
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 284 -NGENProcess 268 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:672
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 268 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2080
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 28c -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1556
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1604
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 27c -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:3056
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"
      2⤵
        PID:1012
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 268 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1328
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
        2⤵
          PID:1852
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2608
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
          2⤵
            PID:1488
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1632
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
            2⤵
              PID:2792
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:304
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
              2⤵
                PID:2828
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 28c -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2264
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"
                2⤵
                  PID:1540
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2424
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"
                  2⤵
                    PID:2900
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 29c -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2572
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
                    2⤵
                      PID:1716
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2a4 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:1460
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
                      2⤵
                        PID:1484
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        PID:1628
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
                        2⤵
                          PID:2920
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:788
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:1768
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"
                          2⤵
                            PID:896
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 250 -Comment "NGen Worker Process"
                            2⤵
                              PID:3036
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"
                              2⤵
                                PID:1628
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d4 -Pipe 260 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2796
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:2372
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e8 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:3052
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f4 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1088
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 308 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1540
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 304 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1408
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 310 -NGENProcess 2cc -Pipe 2fc -Comment "NGen Worker Process"
                                      2⤵
                                        PID:3036
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 30c -Pipe 2ec -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2720
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2132
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2cc -Pipe 2f8 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1244
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 308 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1328
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2e8 -Pipe 300 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:3052
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2cc -Pipe 310 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:936
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1856
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2e8 -Pipe 318 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2236
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2cc -Pipe 31c -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1124
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 30c -Pipe 320 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1000
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2e8 -Pipe 324 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2088
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2cc -Pipe 328 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2320
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:1068
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2e8 -Pipe 330 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2128
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2cc -Pipe 334 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2192
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:2420
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 340 -NGENProcess 2e8 -Pipe 1f4 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1476
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 33c -NGENProcess 108 -Pipe 2cc -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2536
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 354 -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2092
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2e8 -Pipe 348 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:1904
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 108 -Pipe 34c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:3064
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 30c -Pipe 350 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                • Loads dropped DLL
                                                                                • Drops file in Windows directory
                                                                                PID:2264
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 30c -NGENProcess 358 -Pipe 2e8 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2128
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 368 -NGENProcess 108 -Pipe 33c -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2404
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2420
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:3036
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 108 -Pipe 340 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2076
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 364 -Pipe 360 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2996
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 1b4 -NGENProcess 358 -Pipe 370 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2564
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 384 -NGENProcess 36c -Pipe 380 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2648
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 108 -Pipe 10c -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1296
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 358 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1360
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 36c -Pipe 30c -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2288
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 108 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1632
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 358 -Pipe 1b4 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2480
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 36c -Pipe 384 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2308
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 108 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:2076
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 358 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:3048
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 36c -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:320
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 108 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:3032
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 358 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1540
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 36c -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2244
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 108 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2784
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 358 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1124
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 36c -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:1748
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 108 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2460
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 358 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:2532
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 36c -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2564
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 108 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:3052
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 358 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:2052
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 36c -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1248
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 108 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:2140
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 358 -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:2664
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 358 -NGENProcess 3d8 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:2652
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 3e8 -NGENProcess 108 -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:1684
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 108 -NGENProcess 3e0 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:2824
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 108 -InterruptEvent 3f0 -NGENProcess 3d8 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:1012
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3d8 -NGENProcess 3e8 -Pipe 3ec -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2948
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 3d4 -NGENProcess 410 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1244
                                                                                                                                          • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            C:\Windows\ehome\ehRecvr.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1012
                                                                                                                                          • C:\Windows\ehome\ehsched.exe
                                                                                                                                            C:\Windows\ehome\ehsched.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1464
                                                                                                                                          • C:\Windows\eHome\EhTray.exe
                                                                                                                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:1340
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1708
                                                                                                                                          • C:\Windows\ehome\ehRec.exe
                                                                                                                                            C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2412
                                                                                                                                          • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                            C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1908
                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                            "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2992
                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:2404
                                                                                                                                          • C:\Windows\System32\msdtc.exe
                                                                                                                                            C:\Windows\System32\msdtc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:2972
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1800
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1040
                                                                                                                                          • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            C:\Windows\SysWow64\perfhost.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1592
                                                                                                                                          • C:\Windows\system32\locator.exe
                                                                                                                                            C:\Windows\system32\locator.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2964
                                                                                                                                          • C:\Windows\System32\snmptrap.exe
                                                                                                                                            C:\Windows\System32\snmptrap.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2520
                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2644
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:904
                                                                                                                                          • C:\Windows\system32\wbengine.exe
                                                                                                                                            "C:\Windows\system32\wbengine.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2656
                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2892
                                                                                                                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                            "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:576
                                                                                                                                          • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1980
                                                                                                                                            • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2212144002-1172735686-1556890956-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2212144002-1172735686-1556890956-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                              2⤵
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1808
                                                                                                                                            • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                              "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                                                                              2⤵
                                                                                                                                                PID:2616
                                                                                                                                              • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:1424

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  OSE.EXE
                                                                                                                                                  • Path C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 ecfc6c2cb8069fb996d52fb21263f29bccc0b48d5d5b0f05657246955a458458
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  GROOVE.EXE
                                                                                                                                                  • Path C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                  • Size 30.1MB
                                                                                                                                                  • SHA256 bfe676c89635562097a0f11c5a8b77f13c1b3cf870df454034952f80170e6682
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  maintenanceservice.exe
                                                                                                                                                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 e06e7cf496ccc0c183ac38a8370f176585d8c0e31ea03ab2cea920162ec2b0b1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  elevation_service.exe
                                                                                                                                                  • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                  • Size 2.1MB
                                                                                                                                                  • SHA256 e9c48dad2917f67285430b50bd16384a1597c78acf0dba03f359c5436d893529
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  wmpnetwk.exe
                                                                                                                                                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                  • Size 2.0MB
                                                                                                                                                  • SHA256 6a9a0bb24af61e9071eb7852a6d4e01e08dc67837c424a96b1d7d5ac81f6f385
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  MSS.log
                                                                                                                                                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                  • Size 1024KB
                                                                                                                                                  • SHA256 a59d4da87e6beeb345fd3ac16bbc74a551d7965a81530ff5e52bca5ec3e34b54
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                  • Size 24B
                                                                                                                                                  • SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  mscorsvw.exe
                                                                                                                                                  • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 61d48d60d9ef2bacd9b1a52783e11b134a865e80710d02aefe31ed3d18445a92
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ngen_service.log
                                                                                                                                                  • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                  • Size 872KB
                                                                                                                                                  • SHA256 75a1ebaa520d3e1421fcb7e640ed5afc05ac59ea91c4edbf34b2e1716e122718
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  mscorsvw.exe
                                                                                                                                                  • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 de1f88bffb8666c2665e0322daf81265460cd9d105c34e7b65873d10a76e1a48
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ngen_service.log
                                                                                                                                                  • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 a6ca6850b7058f04f8182e45b36e6d4393f650cd9a989d13b6936cf7b06be790
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  mscorsvw.exe
                                                                                                                                                  • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 c792b07afc8b0fdc183874ce6a14db21d9fb6515cfb8b3c7d503543c679ee779
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ngen_service.log
                                                                                                                                                  • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                  • Size 1003KB
                                                                                                                                                  • SHA256 d3f43692e4b15ef19921fb9811d0357a5895a12b7da7990d0f6df696d6a64d09
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  mscorsvw.exe
                                                                                                                                                  • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 1f1a0facd5a8f43417d152b11edab97e6a919b752d62d7661ed3568b31d76467
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  perfhost.exe
                                                                                                                                                  • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 9d7e2709b0f168a41e541312eacd10addf10957df6ea06d32af412da442f4bd6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  SearchIndexer.exe
                                                                                                                                                  • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                  • Size 1.1MB
                                                                                                                                                  • SHA256 528242df32bbce195bef047bfe230c72840a545cac6fce6d581576775b14613a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  VSSVC.exe
                                                                                                                                                  • Path C:\Windows\System32\VSSVC.exe
                                                                                                                                                  • Size 2.1MB
                                                                                                                                                  • SHA256 e51652b7e3c7c32860de76c7b5ec1d2a89e05ba95c4fdad87ec7a90ff2f50982
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  alg.exe
                                                                                                                                                  • Path C:\Windows\System32\alg.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 6b45d1168d9197c00088762f3b1e82220211cc94ef0611b4c8a7d9559ee82d91
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  msdtc.exe
                                                                                                                                                  • Path C:\Windows\System32\msdtc.exe
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 1862af63629aae0ed200c12be0ec26e42bd47a337263909dac15da7bd88364ef
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  snmptrap.exe
                                                                                                                                                  • Path C:\Windows\System32\snmptrap.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 a006b1d1273016068bcc3973af13f36dca5c899938f933cef79f7be6dbd1ff04
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  vds.exe
                                                                                                                                                  • Path C:\Windows\System32\vds.exe
                                                                                                                                                  • Size 1.7MB
                                                                                                                                                  • SHA256 7669ef9b62d1cc1d04db2e6fc86a6168042627a142287acefc4b79b89a68139e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  WmiApSrv.exe
                                                                                                                                                  • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 dcaafb27527dec1c4319da532f9607657b0001e6afae67558806d8b88a33dad3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  wbengine.exe
                                                                                                                                                  • Path C:\Windows\System32\wbengine.exe
                                                                                                                                                  • Size 2.0MB
                                                                                                                                                  • SHA256 bc01210279e4e6445551374a7401e8868a3aedb5d396702541ec5bdd8577c032
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Cab119D.tmp
                                                                                                                                                  • Path C:\Windows\Temp\Cab119D.tmp
                                                                                                                                                  • Size 29KB
                                                                                                                                                  • SHA256 a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Tar12B8.tmp
                                                                                                                                                  • Path C:\Windows\Temp\Tar12B8.tmp
                                                                                                                                                  • Size 81KB
                                                                                                                                                  • SHA256 725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                  • Size 105KB
                                                                                                                                                  • SHA256 dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                  • Size 238KB
                                                                                                                                                  • SHA256 0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                  • Size 248KB
                                                                                                                                                  • SHA256 c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                  • Size 1.8MB
                                                                                                                                                  • SHA256 3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                  • Size 1.0MB
                                                                                                                                                  • SHA256 e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Size 58KB
                                                                                                                                                  • SHA256 34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                  • Size 205KB
                                                                                                                                                  • SHA256 4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\222ce8059bac7bfc58e329592a5c3dc8\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Size 122KB
                                                                                                                                                  • SHA256 23fecd8efd725cdcd9fa8a227a4d7b0d78a10d7b1fa4039520a1a104c05e7556
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                  • Size 43KB
                                                                                                                                                  • SHA256 4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                  • Size 198KB
                                                                                                                                                  • SHA256 469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\5abfe2b3ee1db2a6122252bb1ab008d8\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Size 221KB
                                                                                                                                                  • SHA256 98735f7ebc04920b1d09c316952a116aa1f70e0b9c0a01605c6811b4a99bedb1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                  • Size 70KB
                                                                                                                                                  • SHA256 1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6f6ebfe545f75f426c00f249289d2c69\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Size 271KB
                                                                                                                                                  • SHA256 677d2396dc106414d7a8adb23138a39c48f28cd0e7c084a0e7497287fb0eb213
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                  • Size 87KB
                                                                                                                                                  • SHA256 b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Size 82KB
                                                                                                                                                  • SHA256 37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Size 58KB
                                                                                                                                                  • SHA256 1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Size 85KB
                                                                                                                                                  • SHA256 d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                  • Size 298KB
                                                                                                                                                  • SHA256 5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\f1bed30ff58259ca456707e672524ad2\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                  • Size 305KB
                                                                                                                                                  • SHA256 bae10e62648f688df212b963cc67d9226642614162e9d0e3df30122d957c6db2
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                  • Size 43KB
                                                                                                                                                  • SHA256 f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ehiActivScp.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                                  • Size 124KB
                                                                                                                                                  • SHA256 2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ehiVidCtl.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                                  • Size 2.1MB
                                                                                                                                                  • SHA256 5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  stdole.ni.dll
                                                                                                                                                  • Path C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                                  • Size 88KB
                                                                                                                                                  • SHA256 9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ehrecvr.exe
                                                                                                                                                  • Path C:\Windows\ehome\ehrecvr.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 87e978c43017ab0f8f5a3515210e7f0120f5fbbfb63d58131cc1b27bd643df1f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ehsched.exe
                                                                                                                                                  • Path C:\Windows\ehome\ehsched.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 5a61f2fa1be771ef05ac3802576ed4e8c9e62a48df91bcfc03d19cfc8067e759
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  fxssvc.exe
                                                                                                                                                  • Path C:\Windows\system32\fxssvc.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 142bf96d928b7092ee9863ff47ded9641b8faefd732965581420bcc98c92ff64
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  aspnet_state.exe
                                                                                                                                                  • Path \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 a5b126713ddbb60e9e60cf5a64bea297fe77ce7b717faa2c04de51f32d35a663
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Locator.exe
                                                                                                                                                  • Path \Windows\System32\Locator.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 7b9716c48b9c67d075ae883796c6d23a23b600b2541cdff789cd43987ef8058c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  ieetwcollector.exe
                                                                                                                                                  • Path \Windows\System32\ieetwcollector.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 dd434449c68f9d789cf1acbc89ffd03c02ddbefb8968575e8854dd4c95921687
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  msiexec.exe
                                                                                                                                                  • Path \Windows\System32\msiexec.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 53d0ff59af6b4a64ce1597edf86b1ca5c2330dbe41670154b661053ec3a01814
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/520-121-0x0000000100000000-0x00000001001FB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/520-14-0x0000000100000000-0x00000001001FB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/576-237-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/576-518-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/904-468-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/904-215-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1012-82-0x0000000000170000-0x00000000001D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1012-89-0x0000000000170000-0x00000000001D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1012-812-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1012-108-0x0000000001390000-0x00000000013A0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1012-88-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1012-187-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1012-107-0x0000000001380000-0x0000000001390000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1040-178-0x000000002E000000-0x000000002E20C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1040-274-0x000000002E000000-0x000000002E20C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1144-59-0x0000000010000000-0x00000000101FE000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1144-39-0x0000000010000000-0x00000000101FE000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1392-71-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1392-65-0x00000000003F0000-0x0000000000450000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1392-181-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1392-72-0x00000000003F0000-0x0000000000450000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1464-101-0x0000000000370000-0x00000000003D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1464-755-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1464-103-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1464-95-0x0000000000370000-0x00000000003D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1464-192-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1484-472-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1484-454-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1560-511-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1560-529-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1592-182-0x0000000001000000-0x00000000011ED000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1592-360-0x0000000001000000-0x00000000011ED000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1628-675-0x0000000003E70000-0x0000000003F2A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1644-388-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1644-275-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1708-196-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1708-109-0x00000000004C0000-0x0000000000520000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1708-117-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1708-115-0x00000000004C0000-0x0000000000520000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1800-241-0x0000000000540000-0x0000000000749000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1800-157-0x0000000100000000-0x0000000100209000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1800-160-0x0000000000540000-0x0000000000749000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1800-236-0x0000000100000000-0x0000000100209000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1908-122-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1908-771-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1908-204-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1980-539-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1980-250-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2168-548-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2168-612-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2244-926-0x0000000001910000-0x0000000001928000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2244-927-0x0000000001960000-0x000000000196E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2244-928-0x00000000019B0000-0x00000000019CA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2244-929-0x000000001AD90000-0x000000001ADAE000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2376-888-0x0000000000D70000-0x0000000000D7C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2376-890-0x0000000001930000-0x0000000001946000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2376-889-0x00000000018E0000-0x0000000001928000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2376-887-0x0000000000D10000-0x0000000000D1E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2380-526-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2380-551-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2404-151-0x0000000140000000-0x0000000140221000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2412-608-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2412-591-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2520-444-0x0000000100000000-0x00000001001ED000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2520-193-0x0000000100000000-0x00000001001ED000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2528-0-0x0000000140000000-0x000000014016C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2528-94-0x0000000140000000-0x000000014016C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2528-167-0x00000000001E0000-0x0000000000240000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2528-1-0x00000000001E0000-0x0000000000240000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2528-166-0x0000000140000000-0x000000014016C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2528-7-0x00000000001E0000-0x0000000000240000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2528-9-0x00000000001E0000-0x0000000000240000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2596-220-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2596-281-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2608-908-0x000000001ADD0000-0x000000001ADDE000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2608-905-0x00000000018E0000-0x00000000018F6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2608-907-0x000000001ADD0000-0x000000001ADDE000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2608-903-0x00000000018D0000-0x00000000018DC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2608-902-0x0000000001880000-0x000000000188E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2608-904-0x000000001AD10000-0x000000001AD58000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2644-197-0x0000000100000000-0x000000010026B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2644-453-0x0000000100000000-0x000000010026B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2656-221-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2656-487-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2712-470-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2712-516-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2728-132-0x0000000140000000-0x00000001401F4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2728-18-0x0000000140000000-0x00000001401F4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2728-27-0x0000000000320000-0x0000000000380000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2728-19-0x0000000000320000-0x0000000000380000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2744-944-0x000000001AE10000-0x000000001AE58000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2744-943-0x000000001ADF0000-0x000000001AE06000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2744-942-0x000000001ADE0000-0x000000001ADEE000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2744-941-0x0000000001AA0000-0x0000000001AB8000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2828-573-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2828-590-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2856-179-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2856-52-0x00000000007B0000-0x0000000000816000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2856-57-0x00000000007B0000-0x0000000000816000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2856-51-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2892-224-0x0000000100000000-0x000000010021B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2892-507-0x0000000100000000-0x000000010021B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2908-430-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2908-457-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2932-49-0x0000000010000000-0x00000000101F6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2932-31-0x0000000010000000-0x00000000101F6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2964-189-0x0000000100000000-0x00000001001EC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2964-425-0x0000000100000000-0x00000001001EC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2972-153-0x0000000140000000-0x000000014020D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2992-150-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2992-130-0x0000000000380000-0x00000000003E6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2992-219-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2992-125-0x0000000000380000-0x00000000003E6000-memory.dmp
                                                                                                                                                  Download