Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/10/2024, 21:00

General

  • Target

    3fcb1c3dc3dc060290a7c4aacdbd389ec855d6b84016f893e37f0e6391fab557.exe

  • Size

    1.2MB

  • MD5

    d7a50decc7947064cd7a2a9ee9ffbb80

  • SHA1

    912225757f1d13c7a454f98bc309e1485b1f5558

  • SHA256

    3fcb1c3dc3dc060290a7c4aacdbd389ec855d6b84016f893e37f0e6391fab557

  • SHA512

    7d597472a0962136647fcdc9f54d0a6fa4465bda19b0d9c1d53fa844919698d718ddd6d6a077015ee64d21640a59523675e19f6b71f278b1373ad2c049bb733c

  • SSDEEP

    12288:Ccz2DWUKMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xz2DW4SkQ/7Gb8NLEbeZ

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 50 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fcb1c3dc3dc060290a7c4aacdbd389ec855d6b84016f893e37f0e6391fab557.exe
    "C:\Users\Admin\AppData\Local\Temp\3fcb1c3dc3dc060290a7c4aacdbd389ec855d6b84016f893e37f0e6391fab557.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2104
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2976
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2952
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2936
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:896
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1816
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 254 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2356
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 244 -NGENProcess 250 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 25c -NGENProcess 268 -Pipe 1f8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3060
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 26c -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2284
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2208
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 270 -NGENProcess 25c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1468
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 270 -NGENProcess 240 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 270 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1912
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 250 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2340
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 280 -NGENProcess 24c -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2160
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 280 -NGENProcess 250 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 27c -NGENProcess 24c -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1784
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 24c -NGENProcess 264 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 284 -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:896
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 298 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 2a0 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 270 -NGENProcess 24c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2064
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 270 -NGENProcess 284 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 24c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2200
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 200 -NGENProcess 250 -Pipe 218 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 1dc -NGENProcess 27c -Pipe 1f8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1dc -NGENProcess 200 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 1e0 -NGENProcess 27c -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1f0 -NGENProcess 288 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1872
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 27c -NGENProcess 288 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:676
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 1cc -NGENProcess 21c -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 21c -NGENProcess 1f0 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:236
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 270 -NGENProcess 200 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3040
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 200 -NGENProcess 21c -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 2ac -NGENProcess 280 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2708
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 280 -NGENProcess 270 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2352
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 24c -NGENProcess 21c -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:568
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2ac -NGENProcess 284 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 29c -NGENProcess 21c -Pipe 200 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2088
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 21c -NGENProcess 2a0 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 264 -NGENProcess 284 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 284 -NGENProcess 29c -Pipe 2a8 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2b8 -NGENProcess 2a0 -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2a0 -NGENProcess 264 -Pipe 2b4 -Comment "NGen Worker Process"
      2⤵
        PID:2128
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 29c -Pipe 21c -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2096
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 29c -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:828
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2c8 -NGENProcess 264 -Pipe 284 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1468
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 29c -NGENProcess 2c4 -Pipe 2a4 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2768
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 250 -NGENProcess 2cc -Pipe 2a0 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:896
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 2cc -NGENProcess 2c8 -Pipe 264 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1628
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2d8 -NGENProcess 2c4 -Pipe 2c0 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1500
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c4 -NGENProcess 250 -Pipe 2d4 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2112
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c4 -NGENProcess 2d8 -Pipe 2c8 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:844
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2d8 -NGENProcess 2cc -Pipe 250 -Comment "NGen Worker Process"
        2⤵
          PID:2268
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2100
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2c4 -NGENProcess 2f0 -Pipe 2d8 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2816
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2d0 -Pipe 2e0 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2052
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2d0 -NGENProcess 2ec -Pipe 2e8 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2212
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2f8 -NGENProcess 2f0 -Pipe 270 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2300
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2f0 -NGENProcess 2e4 -Pipe 2f4 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:1272
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 300 -NGENProcess 2ec -Pipe 2c4 -Comment "NGen Worker Process"
          2⤵
            PID:3016
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2fc -Pipe 2dc -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:840
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2e4 -Pipe 2d0 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2184
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2ec -Pipe 29c -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2384
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2ec -NGENProcess 304 -Pipe 2fc -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2116
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 304 -NGENProcess 2f8 -Pipe 2e4 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1360
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2f0 -NGENProcess 314 -Pipe 300 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1976
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 2ec -NGENProcess 320 -Pipe 304 -Comment "NGen Worker Process"
            2⤵
            • Modifies data under HKEY_USERS
            PID:276
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 2ec -NGENProcess 31c -Pipe 314 -Comment "NGen Worker Process"
            2⤵
              PID:2656
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 30c -NGENProcess 320 -Pipe 310 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1628
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 32c -NGENProcess 318 -Pipe 2cc -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2560
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 2f8 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"
              2⤵
                PID:2168
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 330 -NGENProcess 2f0 -Pipe 328 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1664
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 318 -Pipe 324 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2652
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 33c -NGENProcess 308 -Pipe 338 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2244
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 2ec -NGENProcess 330 -Pipe 32c -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2384
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 308 -Pipe 30c -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3068
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 344 -NGENProcess 334 -Pipe 318 -Comment "NGen Worker Process"
                2⤵
                  PID:2856
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 330 -Pipe 340 -Comment "NGen Worker Process"
                  2⤵
                    PID:1468
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 308 -Pipe 320 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1756
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 354 -NGENProcess 334 -Pipe 350 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:584
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 33c -NGENProcess 2f8 -Pipe 330 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1548
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 34c -NGENProcess 35c -Pipe 354 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1632
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 2ec -NGENProcess 2f8 -Pipe 344 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:3004
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 358 -NGENProcess 364 -Pipe 34c -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2752
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 308 -NGENProcess 2f8 -Pipe 348 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1272
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 368 -NGENProcess 2ec -Pipe 334 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2196
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 2ec -NGENProcess 360 -Pipe 370 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2876
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 358 -NGENProcess 374 -Pipe 368 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1664
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 33c -NGENProcess 360 -Pipe 35c -Comment "NGen Worker Process"
                    2⤵
                      PID:2384
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 128 -NGENProcess 37c -Pipe 358 -Comment "NGen Worker Process"
                      2⤵
                        PID:2720
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 128 -InterruptEvent 374 -NGENProcess 378 -Pipe 308 -Comment "NGen Worker Process"
                        2⤵
                          PID:2132
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 36c -NGENProcess 364 -Pipe 374 -Comment "NGen Worker Process"
                          2⤵
                            PID:1976
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 2f0 -NGENProcess 378 -Pipe 124 -Comment "NGen Worker Process"
                            2⤵
                              PID:1756
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 33c -NGENProcess 384 -Pipe 36c -Comment "NGen Worker Process"
                              2⤵
                                PID:1160
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 360 -NGENProcess 378 -Pipe 2f8 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2096
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 380 -NGENProcess 38c -Pipe 33c -Comment "NGen Worker Process"
                                  2⤵
                                    PID:752
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 128 -InterruptEvent 37c -NGENProcess 378 -Pipe 380 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2768
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 390 -NGENProcess 360 -Pipe 364 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1696
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 128 -NGENProcess 398 -Pipe 37c -Comment "NGen Worker Process"
                                        2⤵
                                          PID:568
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 128 -NGENProcess 394 -Pipe 360 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1204
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 128 -InterruptEvent 394 -NGENProcess 388 -Pipe 398 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2816
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 384 -NGENProcess 3a4 -Pipe 128 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2712
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 38c -NGENProcess 3a8 -Pipe 3a0 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:1100
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 39c -NGENProcess 3a4 -Pipe 390 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:676
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 378 -NGENProcess 3b0 -Pipe 38c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2268
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 2f0 -NGENProcess 3a4 -Pipe 2ec -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:1628
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 3b4 -NGENProcess 39c -Pipe 394 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1496
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 39c -NGENProcess 378 -Pipe 3b0 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1020
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3bc -NGENProcess 3a4 -Pipe 384 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2452
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 3c0 -NGENProcess 3b4 -Pipe 3bc -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:3016
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3ac -NGENProcess 3a4 -Pipe 2f0 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2300
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3c8 -NGENProcess 3c0 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1408
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3b4 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2384
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3a4 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2492
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3c0 -NGENProcess 3d4 -Pipe 39c -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:856
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3d8 -NGENProcess 3b4 -Pipe 388 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1872
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3a4 -Pipe 3ac -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:1100
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3c0 -NGENProcess 3e4 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:3016
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c8 -NGENProcess 3a4 -Pipe 3cc -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2560
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3e8 -NGENProcess 3dc -Pipe 378 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1552
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 3e4 -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:1784
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3ec -NGENProcess 3e8 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2640
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3ec -NGENProcess 3f0 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:1984
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3e0 -NGENProcess 3e8 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2284
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3fc -NGENProcess 3c0 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:1400
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 408 -NGENProcess 3f0 -Pipe 404 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:840
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 3f8 -NGENProcess 3e0 -Pipe 3d4 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2364
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3e0 -NGENProcess 3c8 -Pipe 3f0 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1824
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 410 -NGENProcess 3fc -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2652
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3fc -NGENProcess 3f8 -Pipe 3e8 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1540
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 418 -NGENProcess 3c8 -Pipe 408 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2352
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 420 -NGENProcess 414 -Pipe 41c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2196
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 3f4 -NGENProcess 3ec -Pipe 3f8 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:2748
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 424 -NGENProcess 410 -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2956
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 414 -Pipe 40c -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:276
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 414 -NGENProcess 3f4 -Pipe 3ec -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2828
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 430 -NGENProcess 410 -Pipe 418 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1520
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 410 -NGENProcess 428 -Pipe 42c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2300
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 438 -NGENProcess 3f4 -Pipe 424 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2140
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 434 -Pipe 3fc -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2712
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2504
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2764
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 238 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1028
                                                                                                                        • C:\Windows\ehome\ehRecvr.exe
                                                                                                                          C:\Windows\ehome\ehRecvr.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          PID:3052
                                                                                                                        • C:\Windows\ehome\ehsched.exe
                                                                                                                          C:\Windows\ehome\ehsched.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1908
                                                                                                                        • C:\Windows\eHome\EhTray.exe
                                                                                                                          "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          PID:2132
                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1932
                                                                                                                        • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                          C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2272
                                                                                                                        • C:\Windows\ehome\ehRec.exe
                                                                                                                          C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                          1⤵
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1688
                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                          "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1416
                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2484
                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2608
                                                                                                                        • C:\Windows\System32\msdtc.exe
                                                                                                                          C:\Windows\System32\msdtc.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:652
                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:608
                                                                                                                        • C:\Windows\SysWow64\perfhost.exe
                                                                                                                          C:\Windows\SysWow64\perfhost.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2240
                                                                                                                        • C:\Windows\system32\locator.exe
                                                                                                                          C:\Windows\system32\locator.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2152
                                                                                                                        • C:\Windows\System32\snmptrap.exe
                                                                                                                          C:\Windows\System32\snmptrap.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1908
                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                          C:\Windows\System32\vds.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1616
                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2860
                                                                                                                        • C:\Windows\system32\wbengine.exe
                                                                                                                          "C:\Windows\system32\wbengine.exe"
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1264
                                                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2108
                                                                                                                        • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                          "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1536
                                                                                                                        • C:\Windows\system32\SearchIndexer.exe
                                                                                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2304
                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3692679935-4019334568-335155002-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3692679935-4019334568-335155002-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                            2⤵
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:2872
                                                                                                                          • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                            "C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600
                                                                                                                            2⤵
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:2508
                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                            2⤵
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:2172

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          0cdf1757160860643a2e0becc5ece866

                                                                                                                          SHA1

                                                                                                                          622b3680a5f06d53d276e3b9636f0db2b9b4f0dc

                                                                                                                          SHA256

                                                                                                                          cc80d2cb14e87a44875fd0a3daab19d44e899e98eeeffcae3d6454d1815782fd

                                                                                                                          SHA512

                                                                                                                          978b78e21205efe520307f3ec1f5f2e0cf8e905f528b2b3f06edd27a7fc8ed41af6f56a20d8d479dcf4ddce6ca9d39cda82a9a07500fb9eb50bb02a9345264f0

                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                                                                                                          Filesize

                                                                                                                          30.1MB

                                                                                                                          MD5

                                                                                                                          fc62b87884c7a6ba512a5704fcfe6f5a

                                                                                                                          SHA1

                                                                                                                          5b70b0cf459aee7bc52005c71eb9c88e806a2fc1

                                                                                                                          SHA256

                                                                                                                          dea7ece741e73305cadd84b49a3e743d6c36527a29f4453f894b99a4fd276a25

                                                                                                                          SHA512

                                                                                                                          d0940bb47c7e0d9e264ce533229666d97c0f2268cb9033b89044e0d3f3e3f50b0dacf11bd1736a27a9224d0461e46dec2d85895fd2b5deffd97fe6d3e7e15213

                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                                                                                          Filesize

                                                                                                                          1.4MB

                                                                                                                          MD5

                                                                                                                          986d4b7a21966a61f8898605db91d4db

                                                                                                                          SHA1

                                                                                                                          6b0b5ac178fa7139bad8c9fa7a0ccda3ffe24857

                                                                                                                          SHA256

                                                                                                                          d7c74847dcccf4ae4448b5ffda2f2eae2abf95bf1d9efc138f98ae93ec05ea0e

                                                                                                                          SHA512

                                                                                                                          a7dcfb7dde873e36bdac820c891360c56298b4efdae2b27d8f02788ebbecaf19d36af823dd56de48b68de6c65812e898286131270a3402816a1c228d4baa676f

                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                                                                                          Filesize

                                                                                                                          2.1MB

                                                                                                                          MD5

                                                                                                                          a251a588deb9db56aa35136ebe078539

                                                                                                                          SHA1

                                                                                                                          440cba8882729fc9aeeefefa5fd94a7a21dd7112

                                                                                                                          SHA256

                                                                                                                          f5b0e4220e5b97000e1e0d7b6c4dfc10fd0f93c57b11d3283ceb7e1366578e66

                                                                                                                          SHA512

                                                                                                                          ef532b4febb3dd7b3684a863fcf414fc036e854b900ed2cbad7051f838c7af24f8a4fef37ca8dea0711f0838710df28629a50a26768f976c198c48c8a0cd0a85

                                                                                                                        • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          MD5

                                                                                                                          51da34a4f22540e7676f7e66bbb3d544

                                                                                                                          SHA1

                                                                                                                          963a8594079797affc9f8761097d2923fbdaaa79

                                                                                                                          SHA256

                                                                                                                          9f28ece875b6bbe68f45aa53fc6d82f4891ba8112988e67c9d09c564ff6fced6

                                                                                                                          SHA512

                                                                                                                          33cc454adcbf59703a93e68a0523ff49a6e5dea120cfb16f4e5b74417b0bff426e8cf6c6adca7cc92c2a7f65ce626e7eece84b8f3f5c4199afce2a7a6c6f524f

                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

                                                                                                                          Filesize

                                                                                                                          24B

                                                                                                                          MD5

                                                                                                                          b9bd716de6739e51c620f2086f9c31e4

                                                                                                                          SHA1

                                                                                                                          9733d94607a3cba277e567af584510edd9febf62

                                                                                                                          SHA256

                                                                                                                          7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                          SHA512

                                                                                                                          cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                                                                                          Filesize

                                                                                                                          872KB

                                                                                                                          MD5

                                                                                                                          93a2e55908fad60b0024e532dc6551f0

                                                                                                                          SHA1

                                                                                                                          846e0343d8f80866ff135a6404d273924e48690d

                                                                                                                          SHA256

                                                                                                                          8d1ecfeb99f8a89606bd6da8a43a4ee9ad8baa8810a6eb59e375933cf9953e93

                                                                                                                          SHA512

                                                                                                                          b59455dd36cef175a6bd3050a541b830d9cfc6d5cd55f3e05c14a951cd1247adfcaf9b8b29b9f6fcf70c78359515f3cf1123b749fadd0f095ffa3428d433ad46

                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          70cd06865f575e0a44679ba5351e2c0d

                                                                                                                          SHA1

                                                                                                                          b906a1c7baa8e5d05004d0bd0926e2ab900b293d

                                                                                                                          SHA256

                                                                                                                          13f3b1cdf52265f8a2e7b5e2aa9ad1931141534defd158cb8cd9862c9d3af86c

                                                                                                                          SHA512

                                                                                                                          829900d4f7a2ebbc5b11a35ddb4fe760de984dd3ac7b3e08f1cbedb4cadd6d068dba38bebff6f4574697ed54acdbf75b6a5e432a08d898dc279e7068d5207aeb

                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          08910de602d22c88a12195b02a382700

                                                                                                                          SHA1

                                                                                                                          8754ce52c9e623afcff73e90c0be1c3286bea10d

                                                                                                                          SHA256

                                                                                                                          d6dfa86efe9e874587750ecb8cd23a7dccffbf8dfeb35f55538be08bd8ac2a63

                                                                                                                          SHA512

                                                                                                                          c120df87216526fa442cda670999308631f5526b18b2625619016142f1865b04082662614a7e8488e8a43a809d70dad1173e3d1c4c4f61db5777bd89daf893c0

                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                                                                                          Filesize

                                                                                                                          1003KB

                                                                                                                          MD5

                                                                                                                          d6dbc435621c13c0e8ad62fc43bd6af0

                                                                                                                          SHA1

                                                                                                                          32b58422faefc0be7066399876735bb5e9c831c5

                                                                                                                          SHA256

                                                                                                                          7fdac32f5e85f37114769117860c14f5964721cf7a0ddb03dfd57804ac169fc7

                                                                                                                          SHA512

                                                                                                                          9d2262a48b4972e762fa894856974559aa1ba837ca4e796098ec17896652e8b652c818176ca833fd20789c160f834bf7785194f52aa7f3de2be2da5b4e62d835

                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          4f33e83d8179f625f00f1ecd887dae7c

                                                                                                                          SHA1

                                                                                                                          7b0dd149a3dbfe9f0aaad7b5e74640bd622a6041

                                                                                                                          SHA256

                                                                                                                          7ebd4f6b8ff76d469d87618e12b8b421afcc284532556331a1271f8d41ac1473

                                                                                                                          SHA512

                                                                                                                          ae9f4aae25be6bdd557ce21cd5e4e505b4d04bbf07f796ff61015b4d6810fb8570e577d4a0e82211dad3d5b864b905be2676579cbc74ed4284e7ac8ff96647ec

                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          MD5

                                                                                                                          a1cc030fdfcfc8c7d2a3229a7a733640

                                                                                                                          SHA1

                                                                                                                          81a3a58f7e7735fa6daba6f7a2a3eee04805764f

                                                                                                                          SHA256

                                                                                                                          ad22209984a2352be24b69a62bac9726930bb03e23a81acb058601c18ef89350

                                                                                                                          SHA512

                                                                                                                          9f97db1a73ac564a83f2fec01b6f9f6841805361625cb4133f1a00ae06a5a0d2eaf75dfe355194bd956973bae9352f017a4998b67635a123ce7f4c6ae6bb714c

                                                                                                                        • C:\Windows\SysWOW64\perfhost.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          c21dffb0ef7e61b2daaea7f235900796

                                                                                                                          SHA1

                                                                                                                          f0da9aee962673b7bdad10a3df63967933c89e40

                                                                                                                          SHA256

                                                                                                                          3f32761069403db329055642199eb386351b4e2f862fb458b3eeca1c4f176d66

                                                                                                                          SHA512

                                                                                                                          db43b8a894d471eec9320ba61cc80f2c7329fa77464596256236a5169e780e775ebc2847bebab81fd85e0ace9b8360420b89ed1897eb07a98ecf13ba8e4f5c48

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          834KB

                                                                                                                          MD5

                                                                                                                          c76656b09bb7df6bd2ac1a6177a0027c

                                                                                                                          SHA1

                                                                                                                          0c296994a249e8649b19be84dce27c9ddafef3e0

                                                                                                                          SHA256

                                                                                                                          a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0

                                                                                                                          SHA512

                                                                                                                          8390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          797KB

                                                                                                                          MD5

                                                                                                                          aeb0b6e6c5d32d1ada231285ff2ae881

                                                                                                                          SHA1

                                                                                                                          1f04a1c059503896336406aed1dc93340e90b742

                                                                                                                          SHA256

                                                                                                                          4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263

                                                                                                                          SHA512

                                                                                                                          e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          163KB

                                                                                                                          MD5

                                                                                                                          e88828b5a35063aa16c68ffb8322215d

                                                                                                                          SHA1

                                                                                                                          8225660ba3a9f528cf6ac32038ae3e0ec98d2331

                                                                                                                          SHA256

                                                                                                                          99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142

                                                                                                                          SHA512

                                                                                                                          e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          006498313e139299a5383f0892c954b9

                                                                                                                          SHA1

                                                                                                                          7b3aa10930da9f29272154e2674b86876957ce3a

                                                                                                                          SHA256

                                                                                                                          489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c

                                                                                                                          SHA512

                                                                                                                          6a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          148KB

                                                                                                                          MD5

                                                                                                                          ac901cf97363425059a50d1398e3454b

                                                                                                                          SHA1

                                                                                                                          2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

                                                                                                                          SHA256

                                                                                                                          f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

                                                                                                                          SHA512

                                                                                                                          6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          34KB

                                                                                                                          MD5

                                                                                                                          c26b034a8d6ab845b41ed6e8a8d6001d

                                                                                                                          SHA1

                                                                                                                          3a55774cf22d3244d30f9eb5e26c0a6792a3e493

                                                                                                                          SHA256

                                                                                                                          620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

                                                                                                                          SHA512

                                                                                                                          483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          41KB

                                                                                                                          MD5

                                                                                                                          3c269caf88ccaf71660d8dc6c56f4873

                                                                                                                          SHA1

                                                                                                                          f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

                                                                                                                          SHA256

                                                                                                                          de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

                                                                                                                          SHA512

                                                                                                                          bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          356KB

                                                                                                                          MD5

                                                                                                                          87111e9d98dc79165dfc98a1fb93100b

                                                                                                                          SHA1

                                                                                                                          4f5182e5ce810f6ba3bdb3418ad33c916b6013c8

                                                                                                                          SHA256

                                                                                                                          971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42

                                                                                                                          SHA512

                                                                                                                          abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5be0914ec6bc775ef1c7f93f75a1861a\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          180KB

                                                                                                                          MD5

                                                                                                                          35aefa05e77d58d31272bb94c0ef25f5

                                                                                                                          SHA1

                                                                                                                          bef4874a17cfe29939ca24f0adbdaadb80670632

                                                                                                                          SHA256

                                                                                                                          efbfd4c3ca295cd7fdfc67072136668b0c7de72d40162bc28e6ae919eee6c66e

                                                                                                                          SHA512

                                                                                                                          e88c5c7e7a37ab8db4ba704d172651de429de39abf8a07f166cf90fad939fdf6bfc94604111bfad534d5159f60e7d63b34a69cc7c55fbe7ad6680aa0a9063327

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          0637ad2bf6fc5ac1d29e547155bc818c

                                                                                                                          SHA1

                                                                                                                          a502879466b6dd37eae5881bbb18353f97623852

                                                                                                                          SHA256

                                                                                                                          868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f

                                                                                                                          SHA512

                                                                                                                          1d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          53KB

                                                                                                                          MD5

                                                                                                                          e3a7a2b65afd8ab8b154fdc7897595c3

                                                                                                                          SHA1

                                                                                                                          b21eefd6e23231470b5cf0bd0d7363879a2ed228

                                                                                                                          SHA256

                                                                                                                          e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

                                                                                                                          SHA512

                                                                                                                          6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          65KB

                                                                                                                          MD5

                                                                                                                          da9f9a01a99bd98104b19a95eeef256c

                                                                                                                          SHA1

                                                                                                                          272071d5bbc0c234bc2f63dfcd5a90f83079bbab

                                                                                                                          SHA256

                                                                                                                          b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d

                                                                                                                          SHA512

                                                                                                                          dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          28KB

                                                                                                                          MD5

                                                                                                                          aefc3f3c8e7499bad4d05284e8abd16c

                                                                                                                          SHA1

                                                                                                                          7ab718bde7fdb2d878d8725dc843cfeba44a71f7

                                                                                                                          SHA256

                                                                                                                          4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

                                                                                                                          SHA512

                                                                                                                          1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b9381ac11dba1ef82244fd8b941ba9be\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          83KB

                                                                                                                          MD5

                                                                                                                          39ac1325c34fee4b56c2c65d0a5505ea

                                                                                                                          SHA1

                                                                                                                          34e6839d764ac8dd93c6fb7941ec27b9b8a5ecf1

                                                                                                                          SHA256

                                                                                                                          f3293590fea3bf781181268edd9124a828409103782a8a4048b1efd485dd76a4

                                                                                                                          SHA512

                                                                                                                          43a124619b5aabec1ed92cc14490876dd4cf7ef1fbefd334d810dceeed834b3acf0ac8e2b0aa8d6b6287c032e2d9341fdc78747e440553f966280b9e0b1e6bf4

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          278KB

                                                                                                                          MD5

                                                                                                                          d74d434aa70ce827715b5e0ac7eda5be

                                                                                                                          SHA1

                                                                                                                          b53f3374be4c96af51c78fd873de1360f17c200f

                                                                                                                          SHA256

                                                                                                                          54701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496

                                                                                                                          SHA512

                                                                                                                          631d09a0ff39ece829f5c23278c2c030e5ff758b285128edb7805682de75b5be1aedd914d2325f79ec98d0103660a39ae1f1a5782f5dad038b143f3774c098df

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          27KB

                                                                                                                          MD5

                                                                                                                          9c60454398ce4bce7a52cbda4a45d364

                                                                                                                          SHA1

                                                                                                                          da1e5de264a6f6051b332f8f32fa876d297bf620

                                                                                                                          SHA256

                                                                                                                          edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

                                                                                                                          SHA512

                                                                                                                          533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          57KB

                                                                                                                          MD5

                                                                                                                          6eaaa1f987d6e1d81badf8665c55a341

                                                                                                                          SHA1

                                                                                                                          e52db4ad92903ca03a5a54fdb66e2e6fad59efd5

                                                                                                                          SHA256

                                                                                                                          4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e

                                                                                                                          SHA512

                                                                                                                          dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          130KB

                                                                                                                          MD5

                                                                                                                          2735d2ab103beb0f7c1fbd6971838274

                                                                                                                          SHA1

                                                                                                                          6063646bc072546798bf8bf347425834f2bfad71

                                                                                                                          SHA256

                                                                                                                          f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

                                                                                                                          SHA512

                                                                                                                          fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f030ae7a0ac8395493f8afcd319ee692\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          143KB

                                                                                                                          MD5

                                                                                                                          f786ebe6116b55d4dc62a63dfede2ca6

                                                                                                                          SHA1

                                                                                                                          ab82f3b24229cf9ad31484b3811cdb84d5e916e9

                                                                                                                          SHA256

                                                                                                                          9805ae745d078fc9d64e256d4472c0edd369958a6872d71bd28d245a0239fe12

                                                                                                                          SHA512

                                                                                                                          80832872329611c5c68784196f890859f6f7c5795f6a62542ad20be813e587341b36ade410363646c43f9ced48d2cf89a4537fe60d90e868324270f7040c2738

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          59KB

                                                                                                                          MD5

                                                                                                                          8c69bbdfbc8cc3fa3fa5edcd79901e94

                                                                                                                          SHA1

                                                                                                                          b8028f0f557692221d5c0160ec6ce414b2bdf19b

                                                                                                                          SHA256

                                                                                                                          a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

                                                                                                                          SHA512

                                                                                                                          825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

                                                                                                                          Filesize

                                                                                                                          42KB

                                                                                                                          MD5

                                                                                                                          71d4273e5b77cf01239a5d4f29e064fc

                                                                                                                          SHA1

                                                                                                                          e8876dea4e4c4c099e27234742016be3c80d8b62

                                                                                                                          SHA256

                                                                                                                          f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

                                                                                                                          SHA512

                                                                                                                          41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE35D.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

                                                                                                                          Filesize

                                                                                                                          210KB

                                                                                                                          MD5

                                                                                                                          4f40997b51420653706cb0958086cd2d

                                                                                                                          SHA1

                                                                                                                          0069b956d17ce7d782a0e054995317f2f621b502

                                                                                                                          SHA256

                                                                                                                          8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

                                                                                                                          SHA512

                                                                                                                          e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF3B2.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll

                                                                                                                          Filesize

                                                                                                                          109KB

                                                                                                                          MD5

                                                                                                                          0fd0f978e977a4122b64ae8f8541de54

                                                                                                                          SHA1

                                                                                                                          153d3390416fdeba1b150816cbbf968e355dc64f

                                                                                                                          SHA256

                                                                                                                          211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60

                                                                                                                          SHA512

                                                                                                                          ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPFD81.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

                                                                                                                          Filesize

                                                                                                                          187KB

                                                                                                                          MD5

                                                                                                                          25350021215e19cd5deebe40409303a8

                                                                                                                          SHA1

                                                                                                                          230ae3fc9c03577169a9500efac8b784b9d0cca5

                                                                                                                          SHA256

                                                                                                                          fa781fa3731332d09bb01106cb3e1fe06a2db5821223cd8fde980fdc519b5ff9

                                                                                                                          SHA512

                                                                                                                          07dc670a78e8fe9226e34a624d89342d5dd459e1fd273132a4501171895e695080b6ff4d057d0088c452f323873e7c5907b0a41f418445e44915994a2965957b

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll

                                                                                                                          Filesize

                                                                                                                          855KB

                                                                                                                          MD5

                                                                                                                          7812b0a90d92b4812d4063b89a970c58

                                                                                                                          SHA1

                                                                                                                          3c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea

                                                                                                                          SHA256

                                                                                                                          897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543

                                                                                                                          SHA512

                                                                                                                          634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed

                                                                                                                        • C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll

                                                                                                                          Filesize

                                                                                                                          43KB

                                                                                                                          MD5

                                                                                                                          3e72bdd0663c5b2bcd530f74139c83e3

                                                                                                                          SHA1

                                                                                                                          66069bcac0207512b9e07320f4fa5934650677d2

                                                                                                                          SHA256

                                                                                                                          6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

                                                                                                                          SHA512

                                                                                                                          b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

                                                                                                                        • C:\Windows\system32\fxssvc.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          c11414d5b283817e256941b17199ece6

                                                                                                                          SHA1

                                                                                                                          ddbfcf343030ef5e73c1845bf17bec36396ee386

                                                                                                                          SHA256

                                                                                                                          6dbd37a56c108bafcc048afcb597b77cec29f0ce954c732357a4ccc2538d8152

                                                                                                                          SHA512

                                                                                                                          5851a77996420038b15a0a510dd133050e37505f7dd313c73036550d6b2aeee0843409bd595cfe54c0f1b0ae19f2e8ef363d13a1e1e20ef07a63c27c9c1ac7ea

                                                                                                                        • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          205eb03f13e86dfba30cd40db89f1814

                                                                                                                          SHA1

                                                                                                                          236369463b83431ea5f6be6b4d85fcbd2ce191d2

                                                                                                                          SHA256

                                                                                                                          2cb45b1ebd4a9bb45a516a868e6bd350771b802e405372b64c26c12c1df9cc42

                                                                                                                          SHA512

                                                                                                                          72107ad6b823a05e0cd8b887d553cf16c0609d757590da542fc9e496f8f0ee5e9edc2e6aff0ead3f43f68d7fca916db3cd6acedc55faa75914aafbd5f7386c73

                                                                                                                        • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          98975ce474feb9a2b5eea291be80c6f4

                                                                                                                          SHA1

                                                                                                                          d8150656f783a562e36876c3208d895ea3598d4c

                                                                                                                          SHA256

                                                                                                                          40d259ad1dc1ab114a4288ad422a6670c2c9b9ac5310b0d4502156ed4163e2ad

                                                                                                                          SHA512

                                                                                                                          7165aa03c6eeda28e58c640645a933ef6baca089558ca9b2948e5aa9920bfd4251071110fc8dc4fe986fdf79735728133dc3a94c856a43214d657c4bfdfedb26

                                                                                                                        • \Windows\System32\Locator.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          e6184ad9c04a8b5c81de5745ce3c7f38

                                                                                                                          SHA1

                                                                                                                          cc8b9745a6d9ca61afd74edb6fbacb9ced6e03db

                                                                                                                          SHA256

                                                                                                                          a47cb07ad02159ad68c5b2896e8d2d94347d28f27d1c5360d9b82e84bb9fc3a5

                                                                                                                          SHA512

                                                                                                                          bcc9a33e8c70fb60c042814985600d4a733bd98c7d8167c66cd87f5cfab61c50e1636ff92dc16d7cbccead54d235de0d6cebefe8f8979149fb2f1078a1614806

                                                                                                                        • \Windows\System32\alg.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          2aed4577da431f038f8f0c12eeb5354b

                                                                                                                          SHA1

                                                                                                                          05821e8bf75c5a3a8c0faa6016c6224a6e9bd654

                                                                                                                          SHA256

                                                                                                                          06e6ec4882eec20ed9b4b407eaa3e5fa8866ae52e92a6220dfec4e822913ba5c

                                                                                                                          SHA512

                                                                                                                          8af2050c7153cfe812780789165f40ef6c4838813e38988d42fac4d6116cf260af2c80653921e031d808bf5eeb45ba9178b187365265cc030ae94aaa0733bf12

                                                                                                                        • \Windows\System32\ieetwcollector.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          fde916a2922b5126298f1bc6343d7c79

                                                                                                                          SHA1

                                                                                                                          cd3aaf50f166ee5b3e03d0461fbd6b3b07bdd32f

                                                                                                                          SHA256

                                                                                                                          4fae21347925cbec0e4e5ac33c6baf39a1f9a8b7dfe1eb0736b3fed294d476c4

                                                                                                                          SHA512

                                                                                                                          b2b92915268d0f45dbbca94306f225ebbd211f70f2fa55b28cb421e077418ff55f68cc642b3b16ff766001e3d7671659a6782a84bbb6dd1dd80e28d82c224841

                                                                                                                        • \Windows\System32\msdtc.exe

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          a2c9b1af913d9bbc485081c61f0de28f

                                                                                                                          SHA1

                                                                                                                          ee46ae1fd4212d9f62afd3abecfa5746fcd6e5ba

                                                                                                                          SHA256

                                                                                                                          f0840c19259b885ecf2ffd384cca0f9a82477b74ec104da4fd6930fa53905e42

                                                                                                                          SHA512

                                                                                                                          cfcdbac698c792a5c433f3c5b1768c8f5df6426b261a41505e232009718431fa3b4fb232cf3818508791139b837250ed966aa6d2d7386b75723a4a0f4c7cf277

                                                                                                                        • \Windows\System32\msiexec.exe

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          e36fecaf97ee2d06fc72d2a52f80488b

                                                                                                                          SHA1

                                                                                                                          a0efc070462f0e540fb5b9b9aa71ee3b781add97

                                                                                                                          SHA256

                                                                                                                          61213fe29fcbb964e81c122c43c2a493f8b31592ac23f36374b11d15b0c21aa6

                                                                                                                          SHA512

                                                                                                                          cdd3dd40e2852272affa0c28205c845846b322d26334c3eda8df508c8478741d1f99010c42716be686a94f21218477f787d293fa5993229421322187301ba959

                                                                                                                        • \Windows\System32\snmptrap.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          4b741c79e8f2fa5298e181d2dac9fc15

                                                                                                                          SHA1

                                                                                                                          8cde5b9b56397d7bdf05faca9a64137d4c40d5f2

                                                                                                                          SHA256

                                                                                                                          e477a228930f01b8a82ff083c15b74d509abf4501c2fbc6ee3adc5bbde6a2c93

                                                                                                                          SHA512

                                                                                                                          a3c40480c12ef42569302be17158c154c40a3cc6ed0ec7eed2ca32143eb186162c9a5e02d783c086299ce508da72420308e23ff1be2cc76e354e9808c80aa186

                                                                                                                        • \Windows\ehome\ehrecvr.exe

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          MD5

                                                                                                                          526c9fb807bf8dcfcca8a822e48f844b

                                                                                                                          SHA1

                                                                                                                          7d97dc23ee971d7d6f03a4fdab913b8e89ecfc0f

                                                                                                                          SHA256

                                                                                                                          44f41a3af1ff27b4bb2825e91ae245b2977c017ea494c3fa87eee07bc6fb149a

                                                                                                                          SHA512

                                                                                                                          5e4ba7c227bc8a1c66537899ecba38621153eb81a9596dd54d9b8a8471d855427e445cb6e5873730a10d7e4ea16d04a128e0fafb63c9fc4f9a52328a854de2c3

                                                                                                                        • \Windows\ehome\ehsched.exe

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          51500d2ac3303951876b6cea9c56dab1

                                                                                                                          SHA1

                                                                                                                          0542fc36b245eef0cb682bd00b5d34fa22559f24

                                                                                                                          SHA256

                                                                                                                          72e40be5f3b1c41ebaf08becf9fa4be70b658834802ff89f54f4882ddd8d0a2b

                                                                                                                          SHA512

                                                                                                                          c7404e6d70198ed9932bbeca88ae9f27292dc8d861d38d94d021288cb769e2d9fef80e0669b9fbc0bbbdd166f4d94dbe389dcab44988b33db64a433b21ca02d5

                                                                                                                        • memory/608-876-0x00000000005E0000-0x0000000000729000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/608-800-0x0000000100000000-0x0000000100149000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/608-703-0x0000000100000000-0x0000000100149000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/608-715-0x00000000005E0000-0x0000000000729000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/652-799-0x0000000140000000-0x000000014014D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/652-689-0x0000000140000000-0x000000014014D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/896-581-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/896-63-0x0000000010000000-0x000000001013E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/896-569-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/896-64-0x0000000000220000-0x0000000000280000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/896-55-0x0000000000220000-0x0000000000280000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/896-107-0x0000000010000000-0x000000001013E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1008-602-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1028-673-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/1028-665-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/1032-190-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1032-82-0x0000000000810000-0x0000000000876000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/1032-75-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1032-76-0x0000000000810000-0x0000000000876000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/1120-498-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1264-905-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                        • memory/1264-779-0x0000000100000000-0x0000000100202000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                        • memory/1416-297-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          30.1MB

                                                                                                                        • memory/1416-167-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          30.1MB

                                                                                                                        • memory/1468-466-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1468-487-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1520-570-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1524-616-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1524-595-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1536-801-0x0000000100000000-0x000000010020A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                        • memory/1616-759-0x0000000100000000-0x00000001001AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                        • memory/1616-903-0x0000000100000000-0x00000001001AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                        • memory/1616-634-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1628-592-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1652-334-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1652-394-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1784-543-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1784-551-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1784-547-0x0000000003C70000-0x0000000003D2A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          744KB

                                                                                                                        • memory/1816-340-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1816-305-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1908-630-0x0000000140000000-0x0000000140149000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/1908-215-0x0000000140000000-0x0000000140149000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/1908-902-0x0000000100000000-0x000000010012D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1908-134-0x0000000140000000-0x0000000140149000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/1908-741-0x0000000100000000-0x000000010012D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1912-502-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1932-148-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.2MB

                                                                                                                        • memory/1932-232-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.2MB

                                                                                                                        • memory/2044-546-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2064-613-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2064-622-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2104-152-0x0000000001F00000-0x0000000001F60000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2104-151-0x0000000010000000-0x000000001013E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2104-7-0x0000000001F00000-0x0000000001F60000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2104-1-0x0000000001F00000-0x0000000001F60000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2104-0-0x0000000010000000-0x000000001013E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2104-74-0x0000000010000000-0x000000001013E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2108-787-0x0000000100000000-0x000000010015B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.4MB

                                                                                                                        • memory/2152-896-0x0000000100000000-0x000000010012C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2152-729-0x0000000100000000-0x000000010012C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2160-534-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2160-521-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2200-647-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2200-642-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2208-476-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2240-718-0x0000000001000000-0x000000000112D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2240-895-0x0000000001000000-0x000000000112D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2272-277-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2272-164-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2272-676-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2284-464-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2304-803-0x0000000100000000-0x0000000100123000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.1MB

                                                                                                                        • memory/2340-523-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2356-417-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2356-392-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2484-185-0x0000000140000000-0x0000000140161000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.4MB

                                                                                                                        • memory/2484-204-0x0000000140000000-0x0000000140161000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.4MB

                                                                                                                        • memory/2504-91-0x00000000001F0000-0x0000000000250000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2504-99-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2504-97-0x00000000001F0000-0x0000000000250000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2504-199-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2608-358-0x000000002E000000-0x000000002E14C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2608-198-0x000000002E000000-0x000000002E14C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2764-670-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2764-649-0x0000000140000000-0x0000000140145000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/2824-313-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2824-234-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2860-904-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.1MB

                                                                                                                        • memory/2860-768-0x0000000100000000-0x0000000100219000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.1MB

                                                                                                                        • memory/2864-439-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2936-40-0x0000000000240000-0x00000000002A6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/2936-70-0x0000000010000000-0x0000000010136000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2936-45-0x0000000000240000-0x00000000002A6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/2936-39-0x0000000010000000-0x0000000010136000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2952-36-0x0000000000E20000-0x0000000000E80000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2952-146-0x0000000140000000-0x0000000140134000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2952-27-0x0000000140000000-0x0000000140134000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2952-28-0x0000000000E20000-0x0000000000E80000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2976-13-0x0000000100000000-0x000000010013B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2976-110-0x0000000100000000-0x000000010013B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2976-14-0x0000000000170000-0x00000000001D0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/2976-22-0x0000000000170000-0x00000000001D0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/3052-681-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/3052-112-0x0000000000870000-0x00000000008D0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          384KB

                                                                                                                        • memory/3052-207-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/3052-111-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/3060-453-0x0000000000400000-0x000000000053F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB