Overview

overview

10

Static

static

3

2024-10-11...ry.exe

windows7-x64

10

2024-10-11...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2024 20:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe

  • Size

    4.1MB

  • MD5

    a859f6bf1bbb4df6c23bbdc0d4cae460

  • SHA1

    992d843bbbf6cfcc9ecd33f978554955b4044554

  • SHA256

    087853446f05cfe03410073ab6370f1de2106e50970a0d37e1f220e592e17e38

  • SHA512

    03be0abbc579b48507aa7441b3946e7a6a8dd23a008006510dcc79a99e347fae4c429a00422c673a92f2d7f5036a68cc0359b1464e3642233838735c175ef6e3

  • SSDEEP

    98304:IDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HFbx4uR:IDqPe1Cxcxk3ZAEUadzR8yc4HF2

Score
10/10
wannacrydiscoveryransomwarespywarestealerworm

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Contacts a large (3184) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 52 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Drops file in System32 directory 21 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2412
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2736
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2408
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2840
  • C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2228
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1540
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2464
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 250 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:108
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 264 -NGENProcess 244 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2604
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1d8 -NGENProcess 258 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1f0 -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 240 -NGENProcess 258 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1740
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 270 -NGENProcess 1d8 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 26c -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1672
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 240 -NGENProcess 27c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 250 -NGENProcess 26c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2972
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 25c -NGENProcess 284 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2980
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 284 -NGENProcess 274 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2332
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 284 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1152
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 1d8 -NGENProcess 274 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 290 -NGENProcess 268 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 290 -NGENProcess 1d8 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2576
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 28c -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2476
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 29c -NGENProcess 284 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1744
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 1d8 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2820
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 268 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2a8 -NGENProcess 284 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1732
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2764
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1116
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 204 -NGENProcess 200 -Pipe 1ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2312
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 250 -NGENProcess 104 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1152
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 250 -NGENProcess 204 -Pipe 228 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:928
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 248 -NGENProcess 104 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1208
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 1b8 -Pipe 22c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:808
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 104 -NGENProcess 1b8 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1100
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 268 -NGENProcess 200 -Pipe 204 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2568
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 200 -NGENProcess 260 -Pipe 1b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1704
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 270 -NGENProcess 25c -Pipe 1fc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2392
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 25c -NGENProcess 268 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2872
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 26c -NGENProcess 27c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:3052
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2872
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2000
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 25c -NGENProcess 26c -Pipe 104 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1704
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 288 -NGENProcess 260 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2648
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 260 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
        PID:2160
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 250 -NGENProcess 294 -Pipe 288 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1204
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 294 -NGENProcess 26c -Pipe 280 -Comment "NGen Worker Process"
        2⤵
          PID:2512
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 294 -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1100
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 250 -NGENProcess 290 -Pipe 26c -Comment "NGen Worker Process"
          2⤵
            PID:2208
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 2a0 -NGENProcess 200 -Pipe 28c -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1492
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 200 -NGENProcess 294 -Pipe 274 -Comment "NGen Worker Process"
            2⤵
              PID:2472
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 2a8 -NGENProcess 290 -Pipe 298 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2564
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 290 -NGENProcess 2a0 -Pipe 2a4 -Comment "NGen Worker Process"
              2⤵
                PID:1100
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 290 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2516
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 25c -NGENProcess 2a0 -Pipe 2b4 -Comment "NGen Worker Process"
                2⤵
                  PID:1152
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 104 -NGENProcess 250 -Pipe 294 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1832
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 250 -NGENProcess 290 -Pipe 2a8 -Comment "NGen Worker Process"
                  2⤵
                    PID:1768
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 2c0 -NGENProcess 2a0 -Pipe 200 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:3052
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a0 -NGENProcess 104 -Pipe 2bc -Comment "NGen Worker Process"
                    2⤵
                      PID:1608
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c8 -NGENProcess 290 -Pipe 25c -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:1224
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 290 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
                      2⤵
                        PID:2656
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2d0 -NGENProcess 104 -Pipe 250 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        PID:1204
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 104 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
                        2⤵
                          PID:2656
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 104 -NGENProcess 2d0 -Pipe 2c0 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2536
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 2d0 -NGENProcess 290 -Pipe 2c8 -Comment "NGen Worker Process"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:2160
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2e0 -NGENProcess 2b8 -Pipe 2b0 -Comment "NGen Worker Process"
                          2⤵
                            PID:2924
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2e4 -NGENProcess 2a0 -Pipe 2dc -Comment "NGen Worker Process"
                            2⤵
                              PID:1912
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 290 -Pipe 2d8 -Comment "NGen Worker Process"
                              2⤵
                                PID:1720
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2b8 -Pipe 29c -Comment "NGen Worker Process"
                                2⤵
                                  PID:2208
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2a0 -Pipe 104 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:2344
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2a0 -NGENProcess 2e8 -Pipe 290 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:2872
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2656
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2fc -NGENProcess 2f4 -Pipe 2e4 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2988
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2f4 -NGENProcess 2a0 -Pipe 2f8 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:944
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 304 -NGENProcess 2d0 -Pipe 2f0 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:2404
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 300 -Pipe 2e0 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2484
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2a0 -Pipe 2e8 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2564
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 304 -NGENProcess 314 -Pipe 308 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2992
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2ec -NGENProcess 2a0 -Pipe 2fc -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1100
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 318 -NGENProcess 30c -Pipe 2d4 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2612
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 314 -Pipe 2f4 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:2768
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 2ec -NGENProcess 324 -Pipe 318 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1768
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 324 -NGENProcess 304 -Pipe 328 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2208
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 310 -NGENProcess 2d0 -Pipe 300 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2824
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 2ec -NGENProcess 330 -Pipe 324 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2404
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 30c -NGENProcess 2d0 -Pipe 314 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1608
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 334 -NGENProcess 310 -Pipe 31c -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:780
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 334 -NGENProcess 30c -Pipe 330 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2824
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 2a0 -NGENProcess 310 -Pipe 320 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1372
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 340 -NGENProcess 2ec -Pipe 304 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:1644
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 33c -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2492
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 310 -Pipe 32c -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2208
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2ec -Pipe 338 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1100
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 334 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2972
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 30c -NGENProcess 344 -Pipe 358 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:2208
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2a0 -NGENProcess 354 -Pipe 340 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:1912
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 35c -NGENProcess 34c -Pipe 2d0 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1204
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 34c -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2516
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 364 -NGENProcess 354 -Pipe 348 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2404
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 360 -Pipe 350 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:1984
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 2a0 -NGENProcess 30c -Pipe 310 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:3052
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 36c -NGENProcess 19c -Pipe 2ec -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:1204
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 360 -Pipe 350 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:1644
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 30c -Pipe 34c -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2612
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 19c -Pipe 364 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2300
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 360 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:1608
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 30c -Pipe 2a0 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:2612
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 30c -NGENProcess 374 -Pipe 388 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:1832
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 36c -NGENProcess 384 -Pipe 370 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:1204
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 38c -NGENProcess 37c -Pipe 354 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:2824
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 374 -Pipe 19c -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2664
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 384 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:980
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 30c -Pipe 380 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:3056
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 374 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1608
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 384 -Pipe 36c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2812
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 398 -NGENProcess 3a8 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2120
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 38c -NGENProcess 384 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:1224
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3ac -NGENProcess 3a0 -Pipe 360 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2988
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3a0 -NGENProcess 3a4 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2564
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 3b8 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1612
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 30c -NGENProcess 3a4 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2812
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3bc -NGENProcess 394 -Pipe 30c -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:3052
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 384 -NGENProcess 3a4 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:872
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 3c4 -NGENProcess 398 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1648
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 394 -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:780
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3a4 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1204
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 398 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:1608
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 394 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2612
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 394 -NGENProcess 3cc -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:908
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3dc -NGENProcess 398 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1060
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 398 -NGENProcess 3d4 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2208
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 3e4 -NGENProcess 3cc -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:568
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3cc -NGENProcess 3dc -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3056
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3ec -NGENProcess 3d4 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1060
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3ec -NGENProcess 3cc -Pipe 3e8 -Comment "NGen Worker Process"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2364
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2944
                                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                              "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              PID:1908
                                                                                                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1224
                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:676
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:1616
                                                                                                                                                            • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                              C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              PID:2224
                                                                                                                                                            • C:\Windows\ehome\ehsched.exe
                                                                                                                                                              C:\Windows\ehome\ehsched.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1060
                                                                                                                                                            • C:\Windows\eHome\EhTray.exe
                                                                                                                                                              "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                              1⤵
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                              PID:980
                                                                                                                                                            • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                              C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1912
                                                                                                                                                            • C:\Windows\System32\msdtc.exe
                                                                                                                                                              C:\Windows\System32\msdtc.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              PID:756
                                                                                                                                                            • C:\Windows\ehome\ehRec.exe
                                                                                                                                                              C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:1832
                                                                                                                                                            • C:\Windows\system32\msiexec.exe
                                                                                                                                                              C:\Windows\system32\msiexec.exe /V
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2180
                                                                                                                                                            • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                              C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:588
                                                                                                                                                            • C:\Windows\system32\locator.exe
                                                                                                                                                              C:\Windows\system32\locator.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2356
                                                                                                                                                            • C:\Windows\System32\snmptrap.exe
                                                                                                                                                              C:\Windows\System32\snmptrap.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2008
                                                                                                                                                            • C:\Windows\System32\vds.exe
                                                                                                                                                              C:\Windows\System32\vds.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1756
                                                                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:108
                                                                                                                                                            • C:\Windows\system32\wbengine.exe
                                                                                                                                                              "C:\Windows\system32\wbengine.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:1252
                                                                                                                                                            • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                              C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2588
                                                                                                                                                            • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                              "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2144
                                                                                                                                                            • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                              C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2156
                                                                                                                                                              • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3692679935-4019334568-335155002-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3692679935-4019334568-335155002-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                                2⤵
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:2288
                                                                                                                                                              • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                                "C:\Windows\system32\SearchFilterHost.exe" 0 596 600 608 65536 604
                                                                                                                                                                2⤵
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                PID:1624
                                                                                                                                                              • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                2⤵
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:1680

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                              Filesize

                                                                                                                                                              706KB

                                                                                                                                                              MD5

                                                                                                                                                              741526f580a629422019d68f7357be58

                                                                                                                                                              SHA1

                                                                                                                                                              c10f393e72341e4b9693dd10a8df414feb632205

                                                                                                                                                              SHA256

                                                                                                                                                              ee349d55125270152b849693b5bdbda9f4e949d9e31b2226fad7ba13bc93533c

                                                                                                                                                              SHA512

                                                                                                                                                              8ed351097a2306590cf89a2645c26d313f710b8954f8cee79ed4e6eba24b8fc1ae6fada6727a60a2c77036c3b0fd56c7c96fd9679da4d70b4458180797362005

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                              Filesize

                                                                                                                                                              30.1MB

                                                                                                                                                              MD5

                                                                                                                                                              98acfa95a74da756603ef1162148b9ff

                                                                                                                                                              SHA1

                                                                                                                                                              dfdd9ff2a7bcc11cacf87744a6cf69c621dcb621

                                                                                                                                                              SHA256

                                                                                                                                                              1aadad8615b825d4aaca3bcd5e66b31fea69acf259f6d769b115d43789f592a9

                                                                                                                                                              SHA512

                                                                                                                                                              9ee564938390123590dc024ac830ce3e8db7d77520f41eff296d7131a8f2e17c7ffc0d5168b085655f1de3b2d9efbeb7eb866ac33ea8b4b736f19aebad2b4755

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                              Filesize

                                                                                                                                                              781KB

                                                                                                                                                              MD5

                                                                                                                                                              d1a7b1755846d8d61ef9c3bca2f19fde

                                                                                                                                                              SHA1

                                                                                                                                                              702b8125db33321224b518d8dcea24914240ddbf

                                                                                                                                                              SHA256

                                                                                                                                                              8b4e545a1f72dceaea0bcc5a6617a080706a000e3629138c86d031c457661f89

                                                                                                                                                              SHA512

                                                                                                                                                              a7e8f4bedeab04882e3c13c1c542709600efc7310c4644ef5d758e0f5420ccaf54460e4879adc207be424aa1723ebfa336b3dea51e9c52a8473ff00717727271

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              MD5

                                                                                                                                                              b5445b260e278fbe04272c96b676dd45

                                                                                                                                                              SHA1

                                                                                                                                                              175af37d7d19928780ef088a148c4eaa25039d0b

                                                                                                                                                              SHA256

                                                                                                                                                              5bd5983d7915a2869494d3ee56e375b585553b0ca2e8ec6a4449f14ba2b1ca93

                                                                                                                                                              SHA512

                                                                                                                                                              302fdd5546ea2fc68741d1965ebaeb890dc195d1fc8919ddc031d8fb76d8ffd25493a0980b4053400d41b57a13851dc6b890fe9c27b78e0e69fff09073e0ae03

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                              Filesize

                                                                                                                                                              1024KB

                                                                                                                                                              MD5

                                                                                                                                                              51da34a4f22540e7676f7e66bbb3d544

                                                                                                                                                              SHA1

                                                                                                                                                              963a8594079797affc9f8761097d2923fbdaaa79

                                                                                                                                                              SHA256

                                                                                                                                                              9f28ece875b6bbe68f45aa53fc6d82f4891ba8112988e67c9d09c564ff6fced6

                                                                                                                                                              SHA512

                                                                                                                                                              33cc454adcbf59703a93e68a0523ff49a6e5dea120cfb16f4e5b74417b0bff426e8cf6c6adca7cc92c2a7f65ce626e7eece84b8f3f5c4199afce2a7a6c6f524f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                              Filesize

                                                                                                                                                              24B

                                                                                                                                                              MD5

                                                                                                                                                              b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                              SHA1

                                                                                                                                                              9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                              SHA256

                                                                                                                                                              7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                              SHA512

                                                                                                                                                              cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                              Filesize

                                                                                                                                                              872KB

                                                                                                                                                              MD5

                                                                                                                                                              bca7b0a87da695c822a2698139990c93

                                                                                                                                                              SHA1

                                                                                                                                                              77dc3fdaf1cfccb286ddd38003c2d2bf2109de42

                                                                                                                                                              SHA256

                                                                                                                                                              04e2703e83f3583c2d88b953b6dff44572ddbb4974f0f6a3946bcac54d906f58

                                                                                                                                                              SHA512

                                                                                                                                                              f7d1a5de05738d4483895fa7452c9da879b4967e341dcb2bdd959af5f7d8e8c938d50af4ba2e0ea801c4b0cc2a24c86f0ac9bd207d85912720ae9b4d2f309e1d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              678KB

                                                                                                                                                              MD5

                                                                                                                                                              8f113fd9c7d8c6b0f1182c966502f252

                                                                                                                                                              SHA1

                                                                                                                                                              206b029b48b1bbfe13a859773c86681f4678db92

                                                                                                                                                              SHA256

                                                                                                                                                              13ed27806608a4391066efa7306bdd919578d83e48fc7d896adef3bec88c12db

                                                                                                                                                              SHA512

                                                                                                                                                              900ec75b3453c3f6f52280ee2f3a289a7a2aea564e9bb16b58c3ded9be2d8ea48492d655078ab42ad20326c2ca49221aacf8346ff02b6192bbc44610d762d6aa

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              MD5

                                                                                                                                                              6e4b633e231fa81c599714d4741b1bc4

                                                                                                                                                              SHA1

                                                                                                                                                              122edd9a1e09ea8911679cb7583cf9acbe6a8dab

                                                                                                                                                              SHA256

                                                                                                                                                              0c97e996748c2616bf04977eb252e5269df03dd69bea06258404276b395bbdee

                                                                                                                                                              SHA512

                                                                                                                                                              b3f8ede5da5d3585df2cb8375c51645db00b0fb803f347f1cd289d71256930ad9a66ed773df722c94d82944e82ad4a7e2b279e811f8e746216fd332aae028f51

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              625KB

                                                                                                                                                              MD5

                                                                                                                                                              02e224293273df54932797e730f288ef

                                                                                                                                                              SHA1

                                                                                                                                                              406eb94395b6669127f9cb06bed8a9d1386011c2

                                                                                                                                                              SHA256

                                                                                                                                                              f49b723725623607e674d37a66e4da62a477676f555b75607dc5374d07758679

                                                                                                                                                              SHA512

                                                                                                                                                              5cada48d0df5b68bcaf91e2824f8a5a4c2da14d2763af84594acced3be46f80505defc44bcda71108ab76b4a99d5640ff53849bafe7ad8adb942f126af970339

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              656KB

                                                                                                                                                              MD5

                                                                                                                                                              150023c8303d9ed79f0305ed7bcfbbc6

                                                                                                                                                              SHA1

                                                                                                                                                              1b8c2adbe3394a39a4b3bb8b730b7c101216df05

                                                                                                                                                              SHA256

                                                                                                                                                              25510d77a9736def031c1f6a4d21e1461ffbafbb7175804eefa26929e727567a

                                                                                                                                                              SHA512

                                                                                                                                                              6508632907d2a325d38d0da40fb97f9fbbd280f4e3d3f81ff492c67f3978c264b569510c45e43f1448274ea6e556a68a6fb787bea111de62614bb2fc1e1be58a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                              Filesize

                                                                                                                                                              587KB

                                                                                                                                                              MD5

                                                                                                                                                              242ae83c3630421126fe7e3a8ec0bcac

                                                                                                                                                              SHA1

                                                                                                                                                              be155aa2ce2b1bb4e46f1105772ca243c5540564

                                                                                                                                                              SHA256

                                                                                                                                                              8465cb1ba7b6f96f49077d42b9340361b2883c887e96b182fe80fac7f8b13f43

                                                                                                                                                              SHA512

                                                                                                                                                              959fcacee9f8139594ca25abb2bc026569bb0ef0328a5b7eaab47b63ff162735c9aedf0d6911733500159caf504ed2f1896f407695aaab2433ada9ffc273bb20

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\VSSVC.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              MD5

                                                                                                                                                              e6c1292ffb6e29078ecf24a1fa5698d8

                                                                                                                                                              SHA1

                                                                                                                                                              b8bbbc21942115e7a83645e10aa1aba013eef158

                                                                                                                                                              SHA256

                                                                                                                                                              1d52556d81fe87aaa5f18482a29926aeaa343907767843c84efdc584580ff9e4

                                                                                                                                                              SHA512

                                                                                                                                                              1056bd5595f159a1fd9071cf7adaded5a52f480d559df8aaed23b80056719048052aeba8d1daa679eca1da092f0dae026c0f45d86a2869bf384d0e77be9478c7

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\snmptrap.exe
                                                                                                                                                              Filesize

                                                                                                                                                              581KB

                                                                                                                                                              MD5

                                                                                                                                                              dffde75d27d9b6a090c83b50456f1dd9

                                                                                                                                                              SHA1

                                                                                                                                                              f24539cacd9633f4b4bb6886a1b3ca2f172dc5aa

                                                                                                                                                              SHA256

                                                                                                                                                              f878a99463add586ec9a7709f3023ce4bb191c5d297a911a1971e06acaa2b9fe

                                                                                                                                                              SHA512

                                                                                                                                                              51ea7f8114e16e25e5fb6ff4daafcd0c423a69a941ac94dc8880935849ccc3425702f648569197682ad9eacc7157cd8b7928ecf03d6efb28621436d31cf9a453

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\vds.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              MD5

                                                                                                                                                              07461f5bbfa113678efd4df5e2686dc7

                                                                                                                                                              SHA1

                                                                                                                                                              16ddb1a1ba2fb49ab8ae07275d42c47a17886f68

                                                                                                                                                              SHA256

                                                                                                                                                              e7687cc48886e4d7cf2c39e6745cf20bd9d0f5ac376a87966330b489b1ce9b08

                                                                                                                                                              SHA512

                                                                                                                                                              3791f4e4346fff687bf44ec7185fd50062360c0144ba3e1391bd4ba1957ad418355f732259d7aa88010db5fc3eb6cc60f0386e7ff79ba5a6313234a23ac1094d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\System32\wbengine.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              MD5

                                                                                                                                                              a2d274735a43e12031a7211d2097572c

                                                                                                                                                              SHA1

                                                                                                                                                              264689eec9fb89fc9a360054a71013dfa1c92c92

                                                                                                                                                              SHA256

                                                                                                                                                              e3bed2fcd12357736d41455ccf77891e11b61ec5d7eeb41d628b048453a2f44f

                                                                                                                                                              SHA512

                                                                                                                                                              38e38197a419e913c6d08892ad814b8dfba2d866fddb3b25b2e253c709f33956a6f25e5098ac1cd2a64b0b588e837fa4e8294cd726d3b950bf176ae525836520

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Temp\Cab5985.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              29KB

                                                                                                                                                              MD5

                                                                                                                                                              d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                                              SHA1

                                                                                                                                                              e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                                              SHA256

                                                                                                                                                              a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                                              SHA512

                                                                                                                                                              17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\Temp\Tar5AFE.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              81KB

                                                                                                                                                              MD5

                                                                                                                                                              b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                                              SHA1

                                                                                                                                                              7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                                              SHA256

                                                                                                                                                              725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                                              SHA512

                                                                                                                                                              f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              105KB

                                                                                                                                                              MD5

                                                                                                                                                              d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                              SHA1

                                                                                                                                                              9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                              SHA256

                                                                                                                                                              dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                              SHA512

                                                                                                                                                              5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              238KB

                                                                                                                                                              MD5

                                                                                                                                                              0a4ed78b7995d94fa42379f84cd5f8e9

                                                                                                                                                              SHA1

                                                                                                                                                              90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

                                                                                                                                                              SHA256

                                                                                                                                                              0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

                                                                                                                                                              SHA512

                                                                                                                                                              86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              248KB

                                                                                                                                                              MD5

                                                                                                                                                              4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                              SHA1

                                                                                                                                                              f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                              SHA256

                                                                                                                                                              c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                              SHA512

                                                                                                                                                              c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              MD5

                                                                                                                                                              9958f23efa2a86f8195f11054f94189a

                                                                                                                                                              SHA1

                                                                                                                                                              78ec93b44569ea7ebce452765568da5c73511931

                                                                                                                                                              SHA256

                                                                                                                                                              3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

                                                                                                                                                              SHA512

                                                                                                                                                              3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              1.0MB

                                                                                                                                                              MD5

                                                                                                                                                              598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                                              SHA1

                                                                                                                                                              5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                                              SHA256

                                                                                                                                                              e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                                              SHA512

                                                                                                                                                              774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              58KB

                                                                                                                                                              MD5

                                                                                                                                                              3d6987fc36386537669f2450761cdd9d

                                                                                                                                                              SHA1

                                                                                                                                                              7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                              SHA256

                                                                                                                                                              34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                              SHA512

                                                                                                                                                              1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              205KB

                                                                                                                                                              MD5

                                                                                                                                                              0a41e63195a60814fe770be368b4992f

                                                                                                                                                              SHA1

                                                                                                                                                              d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                              SHA256

                                                                                                                                                              4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                              SHA512

                                                                                                                                                              1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0baaaa182638ecbae5e109de0a6a5570\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              305KB

                                                                                                                                                              MD5

                                                                                                                                                              7b788f9e391e7e73a7b1f21d7d9f59e7

                                                                                                                                                              SHA1

                                                                                                                                                              77286d97a419db4ea17bdcb983738736be959f04

                                                                                                                                                              SHA256

                                                                                                                                                              989fee0c54a01a6b967de40c58653c96a2a92c7c621c5b694a3cb33415c7daf2

                                                                                                                                                              SHA512

                                                                                                                                                              c5952cf864e900153f64791f920e2d31163ac24b4d3b883f898fbcc95a3fd2139126b2763b2ffbff34ad16d9a136bfb9db91960dafe9bee1d73a1f30f9ee995d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              43KB

                                                                                                                                                              MD5

                                                                                                                                                              68c51bcdc03e97a119431061273f045a

                                                                                                                                                              SHA1

                                                                                                                                                              6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                              SHA256

                                                                                                                                                              4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                              SHA512

                                                                                                                                                              d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              198KB

                                                                                                                                                              MD5

                                                                                                                                                              9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                              SHA1

                                                                                                                                                              ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                              SHA256

                                                                                                                                                              469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                              SHA512

                                                                                                                                                              58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              70KB

                                                                                                                                                              MD5

                                                                                                                                                              57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                              SHA1

                                                                                                                                                              da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                              SHA256

                                                                                                                                                              1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                              SHA512

                                                                                                                                                              1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              87KB

                                                                                                                                                              MD5

                                                                                                                                                              ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                              SHA1

                                                                                                                                                              4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                              SHA256

                                                                                                                                                              b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                              SHA512

                                                                                                                                                              d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8b42085bba47522d1337b1119fa56854\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              122KB

                                                                                                                                                              MD5

                                                                                                                                                              e7f84e817fee69d9ce90a5691e7ab144

                                                                                                                                                              SHA1

                                                                                                                                                              b363b931b78e03932d81c3624e7c935918e5333f

                                                                                                                                                              SHA256

                                                                                                                                                              f6154f3258e086aaa423802a9c6de2f4700801e93745bbfc5586d99c1cc090d5

                                                                                                                                                              SHA512

                                                                                                                                                              c4b755729215b95c33ced0a93967da57948a214f50c5ba050aba595f2e95ef45cd79239d00948c623ef0289c6cabc09effd6f9d9bedd37d5150088b3ae13b55e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              82KB

                                                                                                                                                              MD5

                                                                                                                                                              2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                              SHA1

                                                                                                                                                              66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                              SHA256

                                                                                                                                                              37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                              SHA512

                                                                                                                                                              cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              58KB

                                                                                                                                                              MD5

                                                                                                                                                              a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                              SHA1

                                                                                                                                                              500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                              SHA256

                                                                                                                                                              1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                              SHA512

                                                                                                                                                              b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              85KB

                                                                                                                                                              MD5

                                                                                                                                                              5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                              SHA1

                                                                                                                                                              dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                              SHA256

                                                                                                                                                              d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                              SHA512

                                                                                                                                                              27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\c9d7683dad650b4ac61adb999e066d7b\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              221KB

                                                                                                                                                              MD5

                                                                                                                                                              42d454e659281161ba82248ba4d06c5c

                                                                                                                                                              SHA1

                                                                                                                                                              91f3ee92daf0f951a73544726c4cf98a17b60148

                                                                                                                                                              SHA256

                                                                                                                                                              9d72f2d1c160c4fc9376cf7f122665ec9f934d5f3c44b80cbcd33c2e16b81068

                                                                                                                                                              SHA512

                                                                                                                                                              0593f6a94914faaa21cba3c7a539615d7654f50578f068cbbeb63472b5bf5c0c1f1a9d1cd02da630f3c6f35d4492ee33c1a386874c79596adeaf7e5e8a119f55

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d39e26467041db050159e6eb37d7170d\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              271KB

                                                                                                                                                              MD5

                                                                                                                                                              6055bed957a703efff2fb6bdc2860d93

                                                                                                                                                              SHA1

                                                                                                                                                              04f8964a77bad0ad0bfe94eaa9ecca6986bb8e32

                                                                                                                                                              SHA256

                                                                                                                                                              0f2759601106afa29f9131ec1981dd0d8cc51d1b0faba8e17e52c5039e2308b4

                                                                                                                                                              SHA512

                                                                                                                                                              090e49ca28dbf8a51a8859bf30288d686992ce9b001dea09335a9d684c1ecf29c5406e1b3b6e79ce4394d3cedcdb4d7741795507b0f6e0c3ded3f59d624ebd79

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              298KB

                                                                                                                                                              MD5

                                                                                                                                                              5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                              SHA1

                                                                                                                                                              1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                              SHA256

                                                                                                                                                              5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                              SHA512

                                                                                                                                                              58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              43KB

                                                                                                                                                              MD5

                                                                                                                                                              dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                              SHA1

                                                                                                                                                              d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                              SHA256

                                                                                                                                                              f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                              SHA512

                                                                                                                                                              8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP79F.tmp\ehiVidCtl.dll
                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              MD5

                                                                                                                                                              10b5a285eafccdd35390bb49861657e7

                                                                                                                                                              SHA1

                                                                                                                                                              62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                              SHA256

                                                                                                                                                              5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                              SHA512

                                                                                                                                                              19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              124KB

                                                                                                                                                              MD5

                                                                                                                                                              929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                              SHA1

                                                                                                                                                              993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                              SHA256

                                                                                                                                                              2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                              SHA512

                                                                                                                                                              effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
                                                                                                                                                              Filesize

                                                                                                                                                              88KB

                                                                                                                                                              MD5

                                                                                                                                                              1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                              SHA1

                                                                                                                                                              4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                              SHA256

                                                                                                                                                              9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                              SHA512

                                                                                                                                                              e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\tasksche.exe
                                                                                                                                                              Filesize

                                                                                                                                                              3.4MB

                                                                                                                                                              MD5

                                                                                                                                                              7f7ccaa16fb15eb1c7399d422f8363e8

                                                                                                                                                              SHA1

                                                                                                                                                              bd44d0ab543bf814d93b719c24e90d8dd7111234

                                                                                                                                                              SHA256

                                                                                                                                                              2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

                                                                                                                                                              SHA512

                                                                                                                                                              83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              648KB

                                                                                                                                                              MD5

                                                                                                                                                              fa23bd72cd0a3b6780703da2d4901433

                                                                                                                                                              SHA1

                                                                                                                                                              3c2dfbf8fd33d46fc9d6435c1ca40dce509dd84f

                                                                                                                                                              SHA256

                                                                                                                                                              eef5c61ef6e95d60211f0ef925307c50a0381181b29a87923ca2c9db47c7ee10

                                                                                                                                                              SHA512

                                                                                                                                                              54d4c22b96e9e4783424c8cf0d1cf257907732e157720067e9522f2be5528f9e4a601ba1b113fc62df4073cb47d15744002290bf6a007ecf9aaa494520acbb3a

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                              Filesize

                                                                                                                                                              603KB

                                                                                                                                                              MD5

                                                                                                                                                              ea0fd078f7f460dc357c447376281c26

                                                                                                                                                              SHA1

                                                                                                                                                              23e80567a79b0d19c669bd94844a380c48ec8888

                                                                                                                                                              SHA256

                                                                                                                                                              ab067d78e8a9fbec22ed908688b671d2c4b589c7cc76ec1d1c45922dc648e761

                                                                                                                                                              SHA512

                                                                                                                                                              c70053ba8f306f7521803fc496dd0e73011b108c2b38ebbbf60481649af9bb31f8f38c6c1c9d00159debcae19ce0c912354fe93b58350bc0fd8a854d843ada45

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\Locator.exe
                                                                                                                                                              Filesize

                                                                                                                                                              577KB

                                                                                                                                                              MD5

                                                                                                                                                              b64231f3e6ec5ec3b8d0067f72ecb0b1

                                                                                                                                                              SHA1

                                                                                                                                                              aaf59f3944c8c12a2c85a629b19ffc3b881edb66

                                                                                                                                                              SHA256

                                                                                                                                                              5472a523e5bd2be6d34eb8b80397378311ca1fd2b28e4c518047f7479f6afdcd

                                                                                                                                                              SHA512

                                                                                                                                                              e28ceeeeda9c501a4933b2a6aa785577f46b90873d7501782355cd416bf04e8bc23a6b6d66dc1a23ccbac45b14b714a188a9ac5dbd760bb2d9b81357b8cb497a

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\alg.exe
                                                                                                                                                              Filesize

                                                                                                                                                              644KB

                                                                                                                                                              MD5

                                                                                                                                                              13b26f730c036f281dda63f89536d0e6

                                                                                                                                                              SHA1

                                                                                                                                                              8b4c680e8fd8352e75c9feefc0a47fb484b613e1

                                                                                                                                                              SHA256

                                                                                                                                                              11c82677d1f973e72767e3baa2d5c1ab8db49b267989cd56ac1615611ee227e4

                                                                                                                                                              SHA512

                                                                                                                                                              0d139631d2b0791012e4015d389b52a959bdae306836fc7a3d3b956ac679f7ae566a4b971eaea5a0efa448c65c10dd53b86519d0d6d25745c653e1a777ba48fa

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\ieetwcollector.exe
                                                                                                                                                              Filesize

                                                                                                                                                              674KB

                                                                                                                                                              MD5

                                                                                                                                                              a8e1f56cf590e25bc136d21bacde6a89

                                                                                                                                                              SHA1

                                                                                                                                                              b0367ff028711b0de99ff461ecd96416aa1fb4d0

                                                                                                                                                              SHA256

                                                                                                                                                              0f6d50da912b5310ab8c8cd9b7406d8f8681332e54c0388232d9b2493b81670e

                                                                                                                                                              SHA512

                                                                                                                                                              53134d23d15301046b24b13950c4629edbdfd527c76aa729557f42d5766f88e54b2989978fb8a4b5a347cb17fe0ef1ed605727e1b47cca3c71412ab772d770c1

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\msdtc.exe
                                                                                                                                                              Filesize

                                                                                                                                                              705KB

                                                                                                                                                              MD5

                                                                                                                                                              0a72459649e643963f226c0a11db6609

                                                                                                                                                              SHA1

                                                                                                                                                              f24a98d66821fb6ba8d6797c54798b731cbeeb98

                                                                                                                                                              SHA256

                                                                                                                                                              4d71e036e79b3dc5af7fc6f171abc8d442673f5212fdf3ba908c95a7e79d9442

                                                                                                                                                              SHA512

                                                                                                                                                              14fa148b0ecacc60a97bcb232f76df2f864b0939ee48ccfc30eab06e07211ae51eb97785a31c4f4341ce32ccfec89a89e3815fa9cf441322f2c743ab2a29b197

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\System32\msiexec.exe
                                                                                                                                                              Filesize

                                                                                                                                                              691KB

                                                                                                                                                              MD5

                                                                                                                                                              d28d29002278d22bf9002067c3660305

                                                                                                                                                              SHA1

                                                                                                                                                              639b423744f5fdcd457b21af2ed28096e0103083

                                                                                                                                                              SHA256

                                                                                                                                                              f1476936eed62c3e568c90b4238e49b9b56970dab1d9667dcda04559373b3952

                                                                                                                                                              SHA512

                                                                                                                                                              1ec830e98ba68d560afc67f5553890b3c3c1502519b1d015da294db440126c2705a7fde7bf2a332db31f5fbf25d65dfcc64360f2cbed99028339a1e0b50d38b5

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\ehome\ehrecvr.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              MD5

                                                                                                                                                              c4468d2ab8876fa0b30ff678f3148f75

                                                                                                                                                              SHA1

                                                                                                                                                              a370a30cb0b7eb9c1def742bd6de60f23541c840

                                                                                                                                                              SHA256

                                                                                                                                                              d047d90a1d3d3e52d15cebd509f418621f6cdb38d4df787a20d2f3fea4185906

                                                                                                                                                              SHA512

                                                                                                                                                              f24b3a07deaf625b05802bd9aeea46b513d3990f02316f2ba143d173540b0e1beb8978bdcdea125b941301f17f8a26d890c1bab7965a6fbe1831d858af0f87c7

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Windows\ehome\ehsched.exe
                                                                                                                                                              Filesize

                                                                                                                                                              691KB

                                                                                                                                                              MD5

                                                                                                                                                              44fa461d9113007665cb04b6cf78ca8c

                                                                                                                                                              SHA1

                                                                                                                                                              5ff2c8730a4821f21d2214046117e2de6a7e0b78

                                                                                                                                                              SHA256

                                                                                                                                                              156a871e30db6e4858eb9ee074cf4813594c43bc1b15392ca60ce7148139563e

                                                                                                                                                              SHA512

                                                                                                                                                              4c469df7960677d98a2ed51569c3ea178980381f2f174726ba08c6ec9e6c64d7a5cab553fb0e4c7d2d4a812da5c194074f33794f04d2fdd9ff6f8e16fe259d42

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/108-342-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/108-355-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/108-715-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/108-860-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/580-399-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/580-388-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/588-848-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              600KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/588-668-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              600KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/676-117-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              724KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/676-281-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              724KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/756-742-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              728KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/756-630-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              728KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/928-916-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1060-602-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              712KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1060-720-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              712KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1116-269-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1116-248-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1152-491-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1152-905-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1152-480-0x0000000003C50000-0x0000000003D0A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              744KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1152-890-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1224-109-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              808KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1224-108-0x0000000000A30000-0x0000000000A90000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1224-102-0x0000000000A30000-0x0000000000A90000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1224-96-0x0000000000A30000-0x0000000000A90000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1224-105-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              808KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1252-721-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1252-861-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1264-65-0x0000000000410000-0x0000000000470000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1264-218-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1264-59-0x0000000000410000-0x0000000000470000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1264-66-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1536-515-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1540-318-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1540-291-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1616-598-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              668KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1616-579-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              668KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1672-431-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1704-327-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1704-352-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1732-573-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1740-411-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1744-541-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1748-409-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1748-422-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1756-695-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1756-859-0x0000000100000000-0x0000000100114000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1908-91-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1908-244-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              30.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1908-95-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              30.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1908-86-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1912-625-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1912-731-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2008-858-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              600KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2008-692-0x0000000100000000-0x0000000100096000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              600KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2144-743-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2144-863-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2156-754-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2156-865-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2180-643-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              712KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2180-753-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              712KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2180-651-0x0000000000550000-0x0000000000602000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              712KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2180-769-0x0000000000550000-0x0000000000602000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              712KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2224-706-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2224-589-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2228-33-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2228-34-0x0000000000370000-0x00000000003D7000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2228-129-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2228-28-0x0000000000370000-0x00000000003D7000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2268-504-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2312-871-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2312-893-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2332-465-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2332-472-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2356-679-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              596KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2356-849-0x0000000100000000-0x0000000100095000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              596KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2408-14-0x00000000008F0000-0x0000000000950000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2408-13-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              656KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2408-20-0x00000000008F0000-0x0000000000950000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2408-104-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              656KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2412-8-0x0000000000220000-0x0000000000287000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2412-42-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2412-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2412-1-0x0000000000220000-0x0000000000287000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2464-331-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2464-308-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2476-537-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2576-519-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2588-740-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              784KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2588-862-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              784KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2604-357-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2604-375-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2656-444-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2656-429-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2668-208-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2668-46-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2668-47-0x00000000004F0000-0x0000000000557000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2668-53-0x00000000004F0000-0x0000000000557000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2764-233-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2764-217-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2768-387-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2820-559-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2840-26-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              628KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2840-128-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              628KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2844-563-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2944-81-0x00000000008F0000-0x0000000000950000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2944-83-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2944-222-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2972-454-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2980-447-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2980-468-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              672KB

                                                                                                                                                              Download