Overview

overview

7

Static

static

3

f09ab90191...0N.exe

windows7-x64

7

f09ab90191...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09-09-2024 09:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f09ab90191c3efe3b9ff04dcc0801220N.exe

  • Size

    1.3MB

  • MD5

    f09ab90191c3efe3b9ff04dcc0801220

  • SHA1

    1abaca481fc42dd0fc8690c5bf9cff3df2f8d7c6

  • SHA256

    86648c521561c256143da24298fdb44ec2a3354eb6eee2c9bb3612312b8f5632

  • SHA512

    55dbbb741ebf897cfdcac645b2aad107ea98e77109bbec9d61d93976f1f485b9ed3d5130ab051aba848e4b190f35ae2d05d0ebb66981345b50dcbbf0a0d6b5e4

  • SSDEEP

    12288:7utu7Hw1KS+kj2s+7u3bVa3w6LXLXkWUKElgYwKz:7uMyKS+w3U3pb4WUKEjf

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\f09ab90191c3efe3b9ff04dcc0801220N.exe
    "C:\Users\Admin\AppData\Local\Temp\f09ab90191c3efe3b9ff04dcc0801220N.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1244
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2584
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2792
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2888
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:3012
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1956
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2848
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 254 -NGENProcess 244 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2232
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1d0 -NGENProcess 264 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:948
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 240 -NGENProcess 244 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 244 -NGENProcess 23c -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2724
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 244 -NGENProcess 240 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1424
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 254 -NGENProcess 274 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3064
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 248 -NGENProcess 240 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2452
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 27c -NGENProcess 244 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1708
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 284 -NGENProcess 260 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2508
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 24c -NGENProcess 23c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1540
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 244 -NGENProcess 288 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 240 -NGENProcess 27c -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2988
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d0 -NGENProcess 23c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 290 -NGENProcess 288 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1284
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 27c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2572
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 288 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 27c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 294 -NGENProcess 23c -Pipe 2a8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1660
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 1d0 -NGENProcess 2a4 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 2ac -NGENProcess 27c -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2548
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2060
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1480
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 1d4 -NGENProcess 208 -Pipe 20c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1252
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 24c -NGENProcess 244 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:868
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 250 -NGENProcess 1d8 -Pipe 22c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2068
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 208 -Pipe 224 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1112
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 244 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:276
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 208 -NGENProcess 244 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2928
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 264 -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2996
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 208 -NGENProcess 1ac -Pipe 228 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1708
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 250 -NGENProcess 268 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1388
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 264 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2160
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 274 -NGENProcess 1ac -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2288
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 250 -NGENProcess 27c -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:948
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 26c -NGENProcess 1ac -Pipe 208 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1536
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1ac -NGENProcess 278 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2840
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 284 -NGENProcess 27c -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1544
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 26c -NGENProcess 28c -Pipe 1ac -Comment "NGen Worker Process"
      2⤵
        PID:1904
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 27c -Pipe 250 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1256
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 288 -NGENProcess 294 -Pipe 26c -Comment "NGen Worker Process"
        2⤵
          PID:2104
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 264 -NGENProcess 27c -Pipe 244 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          PID:2304
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 27c -NGENProcess 290 -Pipe 270 -Comment "NGen Worker Process"
          2⤵
            PID:1708
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 294 -Pipe 280 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            PID:308
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 294 -NGENProcess 264 -Pipe 298 -Comment "NGen Worker Process"
            2⤵
              PID:1992
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2a4 -NGENProcess 290 -Pipe 288 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:276
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 290 -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
              2⤵
                PID:2724
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2ac -NGENProcess 264 -Pipe 27c -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:948
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 264 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
                2⤵
                  PID:1704
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 294 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1684
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
                  2⤵
                    PID:2100
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 290 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2232
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 29c -NGENProcess 2b8 -Pipe 278 -Comment "NGen Worker Process"
                    2⤵
                      PID:2684
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 2c0 -Pipe 264 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:1828
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 29c -NGENProcess 2a4 -Pipe 2c4 -Comment "NGen Worker Process"
                      2⤵
                        PID:2424
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 28c -NGENProcess 2c8 -Pipe 2b4 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:2024
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2c8 -NGENProcess 284 -Pipe 2c0 -Comment "NGen Worker Process"
                        2⤵
                          PID:1464
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2d4 -NGENProcess 2a4 -Pipe 2bc -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:1888
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 28c -NGENProcess 2dc -Pipe 2c8 -Comment "NGen Worker Process"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:948
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2dc -NGENProcess 2ac -Pipe 2e0 -Comment "NGen Worker Process"
                          2⤵
                            PID:448
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 29c -NGENProcess 2cc -Pipe 2b8 -Comment "NGen Worker Process"
                            2⤵
                              PID:1932
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2e4 -NGENProcess 2d8 -Pipe 284 -Comment "NGen Worker Process"
                              2⤵
                                PID:2328
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 2ac -Pipe 2a4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:832
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:2608
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2cc -NGENProcess 2e4 -Pipe 2d8 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:1736
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2e4 -NGENProcess 28c -Pipe 2ac -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1660
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2f8 -NGENProcess 2f0 -Pipe 29c -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    PID:948
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2f0 -NGENProcess 2cc -Pipe 2f4 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:500
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 300 -NGENProcess 28c -Pipe 2ec -Comment "NGen Worker Process"
                                      2⤵
                                        PID:412
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2fc -Pipe 2dc -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2940
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2cc -Pipe 2e4 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2068
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 28c -Pipe 2e8 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:944
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2fc -Pipe 2f8 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1960
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2cc -Pipe 2f0 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2536
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 28c -Pipe 300 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:2808
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2fc -Pipe 304 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2104
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2cc -Pipe 308 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2988
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 28c -Pipe 30c -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:3068
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2fc -Pipe 310 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2044
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2cc -Pipe 314 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2708
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 28c -Pipe 318 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2080
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 324 -Pipe 2d4 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:1960
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 324 -NGENProcess 32c -Pipe 344 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2360
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 33c -NGENProcess 340 -Pipe 320 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:1440
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 334 -NGENProcess 34c -Pipe 324 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1708
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 31c -NGENProcess 340 -Pipe 2cc -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:308
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 350 -NGENProcess 33c -Pipe 338 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1216
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 34c -Pipe 28c -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2160
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 31c -NGENProcess 350 -Pipe 330 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:2280
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 35c -NGENProcess 33c -Pipe 348 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2312
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 34c -Pipe 334 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                  • Loads dropped DLL
                                                                                  • Drops file in Windows directory
                                                                                  PID:2532
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 34c -NGENProcess 31c -Pipe 350 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2952
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 368 -NGENProcess 33c -Pipe 340 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2988
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2976
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 31c -Pipe 35c -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2044
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 31c -NGENProcess 34c -Pipe 378 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:1920
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 358 -NGENProcess 374 -Pipe 360 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2052
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 37c -NGENProcess 36c -Pipe 32c -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2304
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 34c -Pipe 33c -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2676
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 374 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1536
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 388 -NGENProcess 37c -Pipe 384 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2076
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 370 -NGENProcess 374 -Pipe 31c -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:2688
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 390 -NGENProcess 380 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:308
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 37c -Pipe 38c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2924
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 37c -NGENProcess 388 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:1112
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 3a0 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2028
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 358 -NGENProcess 388 -Pipe 34c -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:500
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 3a4 -NGENProcess 37c -Pipe 380 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2532
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 3a0 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2840
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 388 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:808
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 37c -Pipe 36c -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:1216
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 3a0 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2264
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3ac -NGENProcess 3bc -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:920
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 358 -NGENProcess 3a0 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2780
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 3c0 -NGENProcess 3b4 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1416
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 3bc -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2892
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3a0 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2868
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3b4 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1852
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3bc -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2380
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3a0 -Pipe 358 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:608
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3b4 -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:676
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3c8 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1956
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 3c8 -NGENProcess 3d4 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:2940
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3e4 -NGENProcess 3b4 -Pipe 3cc -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:1592
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 37c -NGENProcess 3ec -Pipe 3c8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:448
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 3d0 -NGENProcess 3b4 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:412
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3b4 -NGENProcess 3e8 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:2084
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3f4 -NGENProcess 3ec -Pipe 3dc -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2892
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 3f0 -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2572
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3f0 -NGENProcess 3b4 -Pipe 3e8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:2176
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 3f0 -NGENProcess 3f8 -Pipe 3ec -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2620
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3f4 -NGENProcess 40c -Pipe 404 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2852
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3d0 -NGENProcess 3f8 -Pipe 3d4 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1440
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 410 -NGENProcess 3f0 -Pipe 3fc -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1736
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 40c -Pipe 408 -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1468
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 3f8 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:836
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3f0 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:308
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 40c -Pipe 3f4 -Comment "NGen Worker Process"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1592
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 3f8 -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2028
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 3f0 -Pipe 410 -Comment "NGen Worker Process"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2768
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 40c -Pipe 414 -Comment "NGen Worker Process"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2732
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 430 -NGENProcess 3f8 -Pipe 418 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2332
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 434 -NGENProcess 3f0 -Pipe 41c -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2380
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 40c -Pipe 420 -Comment "NGen Worker Process"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1852
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 3f8 -Pipe 424 -Comment "NGen Worker Process"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1412
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 3f0 -Pipe 428 -Comment "NGen Worker Process"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2924
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 40c -Pipe 42c -Comment "NGen Worker Process"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1292
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 3f8 -Pipe 430 -Comment "NGen Worker Process"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1464
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 3f0 -Pipe 434 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    PID:936
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 3f0 -NGENProcess 444 -Pipe 40c -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2560
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 454 -NGENProcess 3f8 -Pipe 43c -Comment "NGen Worker Process"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:2332
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 3f8 -NGENProcess 44c -Pipe 450 -Comment "NGen Worker Process"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:924
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 45c -NGENProcess 444 -Pipe 448 -Comment "NGen Worker Process"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2272
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 440 -NGENProcess 458 -Pipe 464 -Comment "NGen Worker Process"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:584
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 458 -NGENProcess 454 -Pipe 468 -Comment "NGen Worker Process"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2980
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 3f0 -NGENProcess 438 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3048
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 46c -NGENProcess 45c -Pipe 44c -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:1684
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 45c -NGENProcess 458 -Pipe 454 -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 474 -NGENProcess 438 -Pipe 3f8 -Comment "NGen Worker Process"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:868
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 438 -NGENProcess 46c -Pipe 470 -Comment "NGen Worker Process"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1900
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 47c -NGENProcess 458 -Pipe 3f0 -Comment "NGen Worker Process"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 480 -NGENProcess 478 -Pipe 460 -Comment "NGen Worker Process"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1592
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 478 -NGENProcess 474 -Pipe 488 -Comment "NGen Worker Process"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:2952
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 474 -NGENProcess 438 -Pipe 484 -Comment "NGen Worker Process"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 48c -NGENProcess 47c -Pipe 444 -Comment "NGen Worker Process"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 474 -NGENProcess 478 -Pipe 440 -Comment "NGen Worker Process"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1468
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 46c -NGENProcess 490 -Pipe 480 -Comment "NGen Worker Process"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:996
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 498 -NGENProcess 47c -Pipe 458 -Comment "NGen Worker Process"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 47c -NGENProcess 474 -Pipe 478 -Comment "NGen Worker Process"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 474 -NGENProcess 47c -Pipe 4a0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 47c -NGENProcess 490 -Pipe 49c -Comment "NGen Worker Process"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1440
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 4a8 -NGENProcess 494 -Pipe 46c -Comment "NGen Worker Process"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 4a4 -Pipe 45c -Comment "NGen Worker Process"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:848
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 47c -NGENProcess 4b4 -Pipe 4a8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:608
                                                                                                                                                                                                                    • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                      C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      PID:2144
                                                                                                                                                                                                                    • C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                      C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2324
                                                                                                                                                                                                                    • C:\Windows\eHome\EhTray.exe
                                                                                                                                                                                                                      "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                      PID:1612
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                    • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                                                                                      C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1252
                                                                                                                                                                                                                    • C:\Windows\ehome\ehRec.exe
                                                                                                                                                                                                                      C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:1440
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                                    • C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                      C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:1644
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:772
                                                                                                                                                                                                                    • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                      C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                    • C:\Windows\system32\locator.exe
                                                                                                                                                                                                                      C:\Windows\system32\locator.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2136
                                                                                                                                                                                                                    • C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                      C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2844
                                                                                                                                                                                                                    • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                      C:\Windows\System32\vds.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1844
                                                                                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:2444
                                                                                                                                                                                                                    • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                      "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                    • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                      C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2660
                                                                                                                                                                                                                    • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                      "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:320
                                                                                                                                                                                                                    • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                                                                                      C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                      • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                                                                        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:1532
                                                                                                                                                                                                                      • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                                                                                        "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                        PID:2748

                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      c5036d54450499da8b8004244bd6913a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      94227e2d788440aef3c299875748d8b73a2213ca

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      39879e1a70a54ebda25bed086ef80344019bdb81e305927c6344e4e7a2448526

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      b2c619d2d6fac6611f07a96b2ecbd7762e74080e142602a8946131ae6c55db0f6d41162eb790916aa1f6faf3b70b9de98b02d7c3201aadc674d589a2d440ec46

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      30.1MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      ffd7414a23ea0b3a9f45f6a1e515a766

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      df75d4adddd64aa90728564635e9bae48005a49f

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      7f2087c06cad4b0bb3463e90a8752e2b20e3eaadf6a5d673846b43317702741b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5ad576d73846dd87b2f01bbdb9e697d89457e9ab56717f66799525038440f8c64538c6598a27c10d602a5b767873db3e913877cd0da495f8798366ba2e1b2ea2

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a9ae690f8044c8fe0a1bf55cef13bc5e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      9f11ba1228ea8ac9f0cab756ef4d354d09a43191

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      c603e79883045a4e9fc7ce0caef47c2e93381cdc1ec066de98690f9564d3e246

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      7676e8ad0419a79b846a6b72607243f4b7949cc2f740a7e6de1561719ab36ce41966e04314eaa7d6b2a6be011ea69c96023d1c981e61d4ea5b563f56ba34b432

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      cd04fc4d40fcd04688c0d7730d520a97

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      3108531e488d1d33742d1ba07cdfae42129f8114

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      7b58043d8ef70726386dd826d14b4240d8cc55572083d4a8dfdc83aca0fc893f

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      346fb2c5f822a086834dc986a1dc98101e71a1c727f3f5b743753cdec2f82f0998af8b692698fe3aaab4fb81e5a025301c958da86bc3519913f54ed8c7c53f3a

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1024KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      84ca72efbf79e289bcc90292b8a5580b

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e1246a230739351a44850d75a27bc8052a9462bd

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      9c7bc0480510edd003dc9ee6c8b9cbd42301900b8dfcafc18698c896db1aea1e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      4d037f7fea337a3343456a7c5a7253f38e479faeeb260a189877c752941f81dc6ff55a1087a78f53251428c49979f4f5fd57580cecb4ce146323b4060df0f877

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      24B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      872KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      49aa6ea7f7a9a85cbd9d88b184a680ad

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      ed2a6d51de37e4c8522b2e5ce8cd79682537fc5c

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      cb85c735419b2d9ecf6d1635087a9a57ead39e4f227241c08efe99a333dbad78

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      b354cd74e22ded0884635723c363695837a0d212fbc3e0d3a2a106934db25edc2fd295b08e06ce456a075b69566ae58555e9b057f7188aeb443da65950ffa0e4

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d71b56c5fd358a332c66643bade787f6

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      8a9d658e0149f6b55f771982c7c8c3076a91559b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      02817ea2ac17af3afec0e32624b378dabfb5607d238658b9590b02392a5e6dc2

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      33a45c8e66dd7ab2b988db73d04b701de619200fe6308d4503fffaff024ba5654bbc2b7ee36a4c7e051ce74744269ac929bf42bb2a3374e9d52e5854270e1db5

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      e35fabc637f3bc67588a64003ddf9883

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a8f11675547f9ff3b79c4e933e2179ea03e91b78

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0dd2297223150feb67dc23e9c3d665fa2d2edaab4246c42cd01e8dea1b7e3354

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      a62f496e30c087ebd88e8dfcf22aeab75c6e3ec4436558eba205c65ac8222efb82d1a21e2d791d173a43d183ea01fd92f3c0d6706f1a19dc16ed1d2c77f02390

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      594b199ab1dbb90fb14ddde46d4074f2

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0380bc8bc3d7ec9c0f54561b1b890efe02ce0e26

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      938a4192980a50912c1c505593dc62427856ab450047c7a83a18d41c886dbeda

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      641375de2643c17496ba0ee23e0ee5ddb5838d917e56d48a519caa1e749765e3babf38914e2c559973ef83b053ed971d75899a6c0bbc903ded80ac6fdddfa946

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1003KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      07fc4826b692cba7f4fbacd695fd0fa3

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      eaeb1dd80e54abbf61c0a7800f77b4b4438e7567

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6edc951fda3c36cbac51ffac3bb1c598fd7822fc8bd41338c5baf71a7602f5a5

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      967c3013315d8ad1ca7ec5f9572eb04d3e0f93040ca466e1bc413a7c6e9cf4e22314e7c804dfc71d8d71b71b5a196032008580e676c3f13dc98f01fd24765233

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      424d45745a43ba667e035534a0331fa8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      12ab89ba84a78f3343a2a7378677e33227e52fe6

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      88220e5541b6e6eab9cde31913e3b9e3e7b1b46c5be4e3a65af16433206b6039

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      510497705d61cb1bf8dfc57e4d2bd0c8fda7df8f2721b17c86903841068cbab04abd2599b2609b76c1147986c1790ddeadf93e4ceec9173790b369a59116c27f

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      8efa0c054fe34731d21f3fcdda4bc496

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      002bd89310ba722b1af8d53cad6b4cc363b22723

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      aabef03a857389011280b37d68857c6e6f43d39996c667a112450099487535bb

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      b6fc8a4ed296155cd7051b6774d77b4b13c1db01061850bae62617993c32b6cdd87845a8bed681ee269b33db13a91bf85955241ce201893904e80b32e9b0f0ad

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\Locator.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      05d80b7c9ab6621dff14662a26305a2c

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      af298808bfa643f2885dd1d8b76795ea2a2b7e37

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e503c5eb160ed24f516fa1747b14dadd3a0a0d7ca390f5ca661eb6c9bc3db3d7

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d3d2233c4f9745206eadee6268468603edcf9ce75b2a4494020981e156bec47c3b62995b576ddc0d949067f5c019b2fc97aa78977ff6d2b8a58c5cd99cb1d9f5

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1d6f0fd719dcb985a5ee739a884e7f26

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b87a68528913b3e8083e193021200672011c0bf1

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      cf654a34c687f650c0f323c5bcdaeb9345bc3e427515283de48bb9313da4450c

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      f07b76eb045ae804526f5df2ce3d3f57caa8c780902ea6873ab20f7d93c54b3e4e1d85849cb9e545137a8251e6550774fc78863e99ab7b0d017e2bd3314e0593

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\VSSVC.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1897b5ef704b21e3cc2d06b71f186a89

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      ed9cff808f5cf77b3fb0ecaf4111a3d85a6514a2

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      ead74522bc8133f1dced55971291044bb9c1416f8562db8fb651c558f68dd048

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c863a863cb129d7cede93c6fc31d5093e68f53e032494d721df710f56f281ffcce4db536f8e31827eb195d063f8593260fbc4afe5f1218637ca2f2a19a623b60

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      cafeb607d06bbbc68651983bfe615746

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b4e97f3b2c272b1f9f32245593cc7e005d4a2bda

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      a4b291f9506138e76bfed276cedd02cd3302a478c404d5cd354c0049904687b0

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      9788aa39d2c054a58942f6b351deccab6138d98a63f2d105bc331ec60a67766e8893908a5c3beb5422c84e466403a3dfb918a5306152396bde1140839794fde2

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      db324c1751d1f6b0113599cfa60c1174

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      57bd242d14c26c7347a775d81257d29d3bcf362a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      c32c076783dcc487daef1482d68a65642cb9740a8e89ff390dd9ad43243d9cc0

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      b7b1fdb9ba761979da79d47dbd32f77f8e2b9793ad5fd4d4e05646079e6166ca51865ee0495367aeff17f9179e77de73eaf0fd12cd1425ea32f23a334521e7d4

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      49738cde0c8c159c1c7554ef9b31e048

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      d2c92adef3aaded6868f1bad83776c59dd674527

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4f93e48be80218e2f3542006dacff4221737a2afcd011a18fbc9a517b8a976b1

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      894264cca9456347a6f4c3a966e6fa4554f180c51f27f4b4f0ad7ab868c9d28fe212bfc2385a9bd928669ca7f6136897169dc2334a97da5e3132ad55ca360235

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Temp\Cab5ED3.tmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      29KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\Temp\Tar5F80.tmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      81KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      105KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      7835e60e560a49049ae728698da3d301

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      238KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0a4ed78b7995d94fa42379f84cd5f8e9

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      248KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      9958f23efa2a86f8195f11054f94189a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      78ec93b44569ea7ebce452765568da5c73511931

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.0MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\03f329d9c9188bb78fcb02922fc582db\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      122KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      b4160b5a2259f681879449d461cdbd50

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      d1f97746ad681f75c0713093bf5cbc9fdb2ea965

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      a3a573031e9b08938d6daceddb2a16c9d931810c128713b5f4b04fcf49e2a8f2

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      43b7521d58e2780445b45dcb55d6f0c16757bcf871c512ce3e9b055b02bee202c49c7353e1da89386efaea13af290925230b08c765074155642d22ac41471e35

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      58KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      3d6987fc36386537669f2450761cdd9d

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      205KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0a41e63195a60814fe770be368b4992f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\1bebd91ab69900f01f7b69cbd7f3f14f\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      221KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f3a89363bf2690f3c712ac9a5a69373e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0d76d0145da80af0a4a7d4c793f7bddba47d25e7

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      34c20712e4c860f1fa8b19aa20859163f0686830d5154c0f44f0b09800c65af0

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6878b5cb44dc14bf70da60d3e412857cefe817e18c7455584070dd4500d045e1a9decb15ab9b4ae54ed81c627b232170b68e285aac2d910e4b44b4ff51f5753d

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      43KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      68c51bcdc03e97a119431061273f045a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      198KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\36c5a9d83dfb1b6b1c0202fb505c9daf\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      221KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      78c5a493778f578ef5517fe161162819

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      faf377bdc739623fb5f111d51af97e8c78f11525

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      aa332098d4073a4c4a654d16ec5fd0b6e2b1f284890057e164204d756095dd93

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6a905ef75d2eb909cd30c3916110f6b41a849ff4ed9f4c19e4d5f85ccf05d9b9dd009b351003386778801909d2628ce4c6cd9b1a54e3a0cd1ab9c5496f35cf50

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      91KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      adc5887e89bc56694a193d92898d3518

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      267f14c45a86d50ad627c6cb00626049e9c1ee20

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      04a6857c04546270358d14398fde209e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      596a3e11ac6c303c679edfd6c30aa71e8eaf8a23

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      381KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0811b25e0449e04f782127bc6f8ac5e3

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      dc1766e20ee338b12fa80e3ce0052ef97ddf9e20

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      20d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      70KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\74054b5793bfb8c8c0753b4d4aead8e3\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      947KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      b1aa17d171be82960213057ca35815a9

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      6c68a8a2c524ddbe04395dfa613378bb311aa314

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      c632156c276f9189d0f53addcc1043006d86188e3b74d9c4042ab2110b6cfd4e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6f042aec9c74da86d15322d4300d93e4a9e69ad3555b302d42d7629dfa060209898b4569a380e9da1a785ddb53a6e0cc0f7543606f17ee467277990971c2fc1a

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      87KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      82KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a39eb02e3e4bb81350e51ee9c87df5e4\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      305KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      8f3e428b93460a93d617b11e538a3bd0

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c4f3ea140e7d4ad76bec47a9fa56a001e2a19fe8

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      584ffcb9792ab4a439d0c2cd0d705285f30dccded3a7dc183f6af7498c8d57fc

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3ab5cd7ff712e3925f454d48b55ec5f8c1d9a8122d37c625db60debd7d69b93dd215061a6a41fba3262944cc31c3e40eff8ce489dd31c4f00cf0ac2f6c29b30c

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      58KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ad7d01564f0056d2476f6ae5d257356b\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      436KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      748bed51a810c033b91c660b5776ab95

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      ec2616fb01949fb9fe4b0eea707f7095b69aa9e4

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      45ee38adadeb1586532e8dd4baba14740ccb0801c2e21318c35268543e0ddef7

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      dc0cce4c633b8e43d8f6d565fcfc73d79bfea375a79ae5057af6d3cc1b62f929e34c95bcfe2f7d378ec7f421fafdd9ab73cff454df0934e2d2f45a52580e9df0

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      85KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d89ed292c81ba21dfd63b924dad095aa\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      271KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      8133fa7608bf3cc21ff219b8b94875cc

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      38e4cd503c2265633bc1fe65c1f3cf63d36d16bd

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      98506907ef30407ca34d19d77f8384ffc62b234160217212fda644c82984dc3a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6504dce5096f62b3d95b5909ac441f782b0114978da1361a32818323e4dc7a636ccfc052231a175a2253a064b98736bf6ebe15d2da14e760f7051be2a03c25d7

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\daa561280ac1119d9c2694442212aaea\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      487KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      aefa28d036740086ae52d157f245200a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      d502f55fa76c3cdb69c8ab97321cd9b9a4b68e55

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      75127c1e3a30e544413d7eb24fd726bacf8c3a3951ddba1fc990ad00a7f1cc49

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3943c099644525fc2b3a50f843cc1612a003d4f92a9187b2fcecaaf90b33071bced0db4608a91bb59c6bf5d1f6f4eb158881bf78cced0597b7bc3045d9b66ee3

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      298KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      43KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP80B4.tmp\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      483KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      aae5a97685a809d0a0f661f9319f8a12

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b5fdd4ec4cc057fccc868de4f4910be89e23e48a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      124KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      10b5a285eafccdd35390bb49861657e7

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      88KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      e8dd4799cdf4c9119309cd08bcd3c268

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      10dbe50e899cb6ced584c549439b64aec21bd46a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8243fa96b42ec96877404e77274e3aedc87d5ad7afabdd261e9666e671b8a3df

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      0593d023dd17dcb5b7d50df446a9ff76964dbc0605af09b6cca570e218be2ac7fd1c32e9cf9fd14ba81f4792a89c111bc0b1380fb31cbf1ec7c71062019b41c3

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      566af4e3021ba40623c1877211ff113d

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e21d36fcc87ccd250d36bdc32b53e663177563f5

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      98d3faa55637d01f5c661c35428db9e49bbc4ba46f4a326b3672a19f5c50af95

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      47633a09b3680904d466f47fb2815e169074d22002b31f68650399c13a7d6c4d66358709584343b46efc71d0fad37fba3c902cd4d238564c64b29b25a66d19e6

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      47973026462691a2b97209e1b5dd867f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      fbf3f23544b6c65c44bb239f1d15efa1cc29699a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      171542f5100074c5dbc2cc92dd15eccfbe397f532c68b0c8558c9c82ef85a680

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1c486fb7ca0070bd596af159d7796537a067531f00841f074fd020fc0c7940be1677b2859051836cae7043f9d72df7f264fc4ce0d6141adaad0d6ad886d6c7d5

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\System32\alg.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f53dd96ef5eac3bb35c852034408caff

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      29478b935a546d246f59ff76d61edeb1ca8c133b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6f09b4e36537bacabee6e6512c5209ffe16878aa8186c73b1a61ab8ba15cb6bc

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      60c0606426cd8813129d2863378c46074f87fdb7fbfb35339252b744b4ac5dcd4ea7f6cf7840d5f4ed86f2e8813625ad50ff28d0b8a57e397a552fa11a72a97b

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\System32\ieetwcollector.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      238f9a7b27abd884e577914641e60856

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f028280b52168bc089a11b94ed0e66ce39463e9d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      9354554ab74b99fc38e2aa7e02ad7b31acae12a693e3d12600607409be1982db

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2cbda8fd7349c60fbb7c0f84cf00fac25960659e2b980a912c1e0fd0e1e3750bb8f9d1be10a54cb632f950858677a988ed3c30c93e4b8a19c4cfc3a9b497bc14

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\System32\msdtc.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      80fc49eb995e3a5ef3bfd940791f57ef

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      005c1291ab41583aabcb6202d44f4f4842ffef14

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      3b2ff39787a4dacb97f3a764b5180deb590d3c73e5a28351182cd307a6dddffa

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      78532d353ab9d7ea159ab4a76c18307284db4e79518e3eb465aa8888d7a5a2ecd7431b94f048ec8a99a1ae0424537f68bd54cb368acb7cd0459a4865b50ec352

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\System32\msiexec.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      29ecec78ea4951b02bfeacbeb470dee2

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      54718a5a0e3f650727164cc0a55d22eb1290e97d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e40bd61cafcbc80e0186e3d8f9ab7fbd30c4c35ef76097eed72276884260e5df

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5fd60a57ee61a917455e9514f0a61ac209e0e60d8c1e36b15ae2d40d894ec2806165af253f18815afa38b76ed37faa19df8d836970c435a391a96476d510ac4f

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\System32\wbengine.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      fd94afae89cf4abe21652fc2133c59f0

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f3e9a8571ac0efa039dd0e16c7ca75b63ccb3dfa

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      99333046b8084e33830535262e9bd8f92ef8813b28b3cc572a707e6f5f300310

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      f6d393746ac6912a824d5c4874aa217e6746a2f464f56eaf1dec96e4da297311f3cb48d508c51d45bcca75918ce99216c374d42cd91e9ed9544098630ad08b18

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\ehome\ehrecvr.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      232a8c2081e5f4552161b3ee74031e5f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a1721a3c9c611beb3e3d868bf456cd529469fb72

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      1efe60f81c0ed91ede5aadadcb5b82e840ce2d1ac3382c598b459147d6e2255a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      31a2470b4e1f8c5d0e975578ef51892fed0ac178056ecbb08838b6ffc4cccf3fb2b8b1b3cf5d33649fa80979719847425bd601b7a51691c10fad343450a59e2c

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • \Windows\ehome\ehsched.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      4f14a9fb40378cc1662be59611c4fdda

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      1c9b88751a59f9bf4a1fbe7b2627dcab12145074

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      54633aee86d28a1a1d50d283504b5559915c21eebd3e1af11815cc9ba6dc2750

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6a67bc13c6882e039a14f891e693b5609a7147af7d63795434bc59f238e644641339eb2ac068de4906152401242203c2b316d7552cf6c6fc5a53c1f2e03cbc46

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • memory/276-909-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/276-910-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/276-905-0x00000000018E0000-0x00000000018EC000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/276-906-0x000000001AD00000-0x000000001AD48000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/276-904-0x0000000001860000-0x000000000186E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/276-907-0x00000000018F0000-0x0000000001906000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      88KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/320-361-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/320-741-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/552-197-0x0000000140000000-0x0000000140221000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/552-177-0x0000000140000000-0x0000000140221000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/772-233-0x000000002E000000-0x000000002E20C000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/772-335-0x000000002E000000-0x000000002E20C000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/948-582-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/948-565-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1112-891-0x000000001ACC0000-0x000000001AD08000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1112-892-0x000000001AD10000-0x000000001AD26000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      88KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1112-889-0x00000000018E0000-0x00000000018EE000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1112-890-0x000000001ACA0000-0x000000001ACAC000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1244-77-0x0000000000400000-0x00000000005F5000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1244-7-0x0000000000400000-0x00000000005F5000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1244-0-0x0000000000650000-0x00000000006B6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1244-8-0x0000000000650000-0x00000000006B6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1252-158-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1252-811-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1424-611-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1424-627-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1460-194-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1460-78-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1460-84-0x0000000000370000-0x00000000003D6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1460-79-0x0000000000370000-0x00000000003D6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1480-332-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1480-308-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1644-325-0x0000000100000000-0x0000000100209000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1644-212-0x0000000100000000-0x0000000100209000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1644-326-0x00000000005E0000-0x00000000007E9000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1644-213-0x00000000005E0000-0x00000000007E9000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1844-449-0x0000000100000000-0x000000010026B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.4MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1844-270-0x0000000100000000-0x000000010026B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.4MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1860-305-0x0000000140000000-0x000000014020D000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1860-185-0x0000000140000000-0x000000014020D000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1952-169-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      30.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1952-264-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      30.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1956-447-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1956-357-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2060-289-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2060-311-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2068-701-0x0000000003E70000-0x0000000003F2A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      744KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2136-252-0x0000000100000000-0x00000001001EC000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2136-360-0x0000000100000000-0x00000001001EC000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2144-115-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2144-116-0x0000000000AA0000-0x0000000000B00000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2144-109-0x0000000000AA0000-0x0000000000B00000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2144-214-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2144-842-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2232-512-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2232-569-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2324-794-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2324-133-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2324-224-0x0000000140000000-0x0000000140209000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2388-234-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.2MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2388-147-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.2MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2400-598-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2400-329-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2444-577-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2444-313-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2584-13-0x0000000100000000-0x00000001001FB000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2584-14-0x0000000000850000-0x00000000008B0000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2584-22-0x0000000000850000-0x00000000008B0000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2584-132-0x0000000100000000-0x00000001001FB000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2624-601-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2624-581-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2660-339-0x0000000100000000-0x000000010021B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2660-621-0x0000000100000000-0x000000010021B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2724-614-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2724-599-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2772-349-0x0000000001000000-0x00000000011ED000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2772-236-0x0000000001000000-0x00000000011ED000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2792-28-0x0000000000A00000-0x0000000000A60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2792-36-0x0000000000A00000-0x0000000000A60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2792-145-0x0000000140000000-0x00000001401F4000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2792-27-0x0000000140000000-0x00000001401F4000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2796-93-0x0000000000A60000-0x0000000000AC0000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2796-99-0x0000000000A60000-0x0000000000AC0000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2796-101-0x0000000140000000-0x0000000140205000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2844-265-0x0000000100000000-0x00000001001ED000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2844-373-0x0000000100000000-0x00000001001ED000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2848-450-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2848-507-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2888-51-0x00000000003B0000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2888-40-0x00000000003B0000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2888-39-0x0000000010000000-0x00000000101F6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2888-75-0x0000000010000000-0x00000000101F6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2928-931-0x00000000019C0000-0x00000000019DE000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2928-928-0x0000000000F30000-0x0000000000F48000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2928-929-0x0000000000F60000-0x0000000000F6E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2928-930-0x0000000001980000-0x000000000199A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2984-789-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2984-375-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2996-946-0x0000000001A20000-0x0000000001A36000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      88KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2996-943-0x0000000000F30000-0x0000000000F48000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2996-944-0x0000000000F70000-0x0000000000F7C000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2996-945-0x0000000001A10000-0x0000000001A1E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/2996-947-0x0000000001A40000-0x0000000001A5A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/3012-56-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/3012-64-0x0000000010000000-0x00000000101FE000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/3012-62-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      384KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/3064-622-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/3064-631-0x0000000000400000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download