Analysis

  • max time kernel
    113s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    08/11/2024, 12:24

General

  • Target

    937853addf341fcad48edf60e554f6e73b600b5516b70a5814834ff3b202f16eN.exe

  • Size

    858KB

  • MD5

    f7b2df02e4a9d3b9390af8cf8bf16580

  • SHA1

    755a73d39319c2b1d7d6d06430fb2369411cc1d9

  • SHA256

    937853addf341fcad48edf60e554f6e73b600b5516b70a5814834ff3b202f16e

  • SHA512

    33c2c71572f329c86d5745d6270299f8a15e76fbd27f45ba449dd1f52656a43bb3b3a75ece63c6f8064b6d57c2f6fea4ae7caf88cdc3b69a0fdeca9dbe06bff1

  • SSDEEP

    24576:qpoXTBCRt8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:q+XlOgDUYmvFur31yAipQCtXxc0H

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 38 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 25 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\937853addf341fcad48edf60e554f6e73b600b5516b70a5814834ff3b202f16eN.exe
    "C:\Users\Admin\AppData\Local\Temp\937853addf341fcad48edf60e554f6e73b600b5516b70a5814834ff3b202f16eN.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:840
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:780
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2836
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2824
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2592
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2984
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1000
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 24c -NGENProcess 250 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 25c -NGENProcess 264 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2948
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 260 -NGENProcess 26c -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 240 -NGENProcess 250 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2716
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 270 -NGENProcess 244 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 26c -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 250 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2376
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 270 -NGENProcess 280 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3064
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 240 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1f4 -NGENProcess 268 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2896
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 28c -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2184
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 27c -NGENProcess 278 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 280 -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1184
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 250 -NGENProcess 278 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 298 -NGENProcess 240 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 244 -NGENProcess 278 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2924
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 278 -NGENProcess 27c -Pipe 2a4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1632
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1f4 -NGENProcess 2a0 -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 1f4 -NGENProcess 278 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 294 -NGENProcess 2a0 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:920
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2752
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1108
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1b0 -NGENProcess 1bc -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2104
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 25c -NGENProcess 23c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3040
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2156
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 260 -NGENProcess 25c -Pipe 1bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2288
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 260 -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:456
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 240 -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2340
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 274 -NGENProcess 238 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2272
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 238 -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2124
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 27c -NGENProcess 264 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2096
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 264 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 284 -NGENProcess 260 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:368
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 260 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:592
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 28c -NGENProcess 274 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2580
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 284 -NGENProcess 294 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2484
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 1b0 -NGENProcess 274 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2220
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 274 -NGENProcess 290 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
        PID:2808
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 29c -NGENProcess 294 -Pipe 268 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:472
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 294 -NGENProcess 1b0 -Pipe 298 -Comment "NGen Worker Process"
        2⤵
          PID:1636
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2a4 -NGENProcess 288 -Pipe 294 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2604
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 288 -NGENProcess 290 -Pipe 1b0 -Comment "NGen Worker Process"
          2⤵
            PID:2432
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2ac -NGENProcess 29c -Pipe 27c -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2960
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 29c -NGENProcess 2a4 -Pipe 284 -Comment "NGen Worker Process"
            2⤵
              PID:2980
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2b4 -NGENProcess 290 -Pipe 274 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1016
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2b0 -Pipe 2a8 -Comment "NGen Worker Process"
              2⤵
                PID:2032
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 23c -NGENProcess 2b8 -Pipe 288 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:1244
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 2b8 -NGENProcess 2b4 -Pipe 290 -Comment "NGen Worker Process"
                2⤵
                  PID:2220
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2c4 -NGENProcess 2b0 -Pipe 2ac -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1552
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2b0 -NGENProcess 23c -Pipe 2c0 -Comment "NGen Worker Process"
                  2⤵
                    PID:976
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 29c -Comment "NGen Worker Process"
                    2⤵
                      PID:2580
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
                      2⤵
                        PID:1844
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 23c -Pipe 2b8 -Comment "NGen Worker Process"
                        2⤵
                          PID:2104
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 23c -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"
                          2⤵
                            PID:1596
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2b0 -Comment "NGen Worker Process"
                            2⤵
                              PID:2080
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
                              2⤵
                                PID:2388
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:1740
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2188
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 23c -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2472
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2e4 -NGENProcess 2f4 -Pipe 2cc -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1244
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2a0 -NGENProcess 2d4 -Pipe 2c4 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2980
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2e8 -NGENProcess 2ec -Pipe 2fc -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2104
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2e4 -NGENProcess 300 -Pipe 2a0 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2960
                                          • C:\Windows\ehome\ehRecvr.exe
                                            C:\Windows\ehome\ehRecvr.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Modifies data under HKEY_USERS
                                            PID:1312
                                          • C:\Windows\ehome\ehsched.exe
                                            C:\Windows\ehome\ehsched.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1768
                                          • C:\Windows\eHome\EhTray.exe
                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:976
                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:2576
                                          • C:\Windows\system32\IEEtwCollector.exe
                                            C:\Windows\system32\IEEtwCollector.exe /V
                                            1⤵
                                            • Executes dropped EXE
                                            PID:972
                                          • C:\Windows\ehome\ehRec.exe
                                            C:\Windows\ehome\ehRec.exe -Embedding
                                            1⤵
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:388
                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                            "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                            1⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • System Location Discovery: System Language Discovery
                                            • Modifies data under HKEY_USERS
                                            PID:2164
                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1756
                                          • C:\Windows\System32\msdtc.exe
                                            C:\Windows\System32\msdtc.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            PID:2392
                                          • C:\Windows\system32\msiexec.exe
                                            C:\Windows\system32\msiexec.exe /V
                                            1⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1708
                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                            1⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:2812
                                          • C:\Windows\SysWow64\perfhost.exe
                                            C:\Windows\SysWow64\perfhost.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:1100
                                          • C:\Windows\system32\locator.exe
                                            C:\Windows\system32\locator.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:2064
                                          • C:\Windows\System32\snmptrap.exe
                                            C:\Windows\System32\snmptrap.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:2332
                                          • C:\Windows\System32\vds.exe
                                            C:\Windows\System32\vds.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1672
                                          • C:\Windows\system32\wbengine.exe
                                            "C:\Windows\system32\wbengine.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2424
                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1660
                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                            "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1052
                                          • C:\Windows\system32\SearchIndexer.exe
                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                            1⤵
                                            • Executes dropped EXE
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2764
                                            • C:\Windows\system32\SearchProtocolHost.exe
                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3692679935-4019334568-335155002-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3692679935-4019334568-335155002-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                              2⤵
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1616
                                            • C:\Windows\system32\SearchFilterHost.exe
                                              "C:\Windows\system32\SearchFilterHost.exe" 0 600 604 612 65536 608
                                              2⤵
                                              • Modifies data under HKEY_USERS
                                              PID:1312
                                            • C:\Windows\system32\SearchProtocolHost.exe
                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                              2⤵
                                              • Drops file in System32 directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2544

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                                  Filesize

                                                  706KB

                                                  MD5

                                                  a469915980efd5a3dc365cd23f397ea6

                                                  SHA1

                                                  4633b713d5a6389dac8498289c819a9a3172170f

                                                  SHA256

                                                  52c2ce2da41ff20d537c65b75b1372e426cbd78c94c8bf1e36536e8d031343dd

                                                  SHA512

                                                  c79365d07d0611e3382a1e39878753382d4873d9d54217c7ea6091365fb8a16c782c45add29b6182dc45875686213824afd990d1a79ca2b3b070510a808129ed

                                                • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                                  Filesize

                                                  30.1MB

                                                  MD5

                                                  3f34bd380c8d4634913c453254ee936e

                                                  SHA1

                                                  6e86530971e0fa7e5f2d55caf9c58a97f6995d51

                                                  SHA256

                                                  03b03fed8f1fd410e1dd6aad9f99e4a7f3e4e3bae809ec1e5ba51a428d2eebbe

                                                  SHA512

                                                  cd4602c42c4b124911625306c59334809e871e54c0ae2f0fdb9c7c5d8b91066df62a8da1f7650da10039847ddce41d68f83c77ffa3b732f7ca19cbf179fcfc0c

                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                  Filesize

                                                  781KB

                                                  MD5

                                                  d6f652c07ee395fa0f8f5e98329ad168

                                                  SHA1

                                                  711c918b862f6f3ea8320e84268a5755612d421e

                                                  SHA256

                                                  70801f0ef22c884f5962aedc981787b43bf3c1455e6a495656e25f094bf5243e

                                                  SHA512

                                                  b8d13f6e974cac5c63abe35e077ce6a07580120043c409775e73c44e0fda5b410b7343019f59f90d92ec68d9dbf7f80bc49fea8c9e499aceb2af398888d45edc

                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                  Filesize

                                                  2.1MB

                                                  MD5

                                                  8553729412bd058bd236538091a3e894

                                                  SHA1

                                                  b09bce2454e8ef19667909284f6e04ee86d66240

                                                  SHA256

                                                  851ffe76e28dc97d857be57cfb4c2113f6c1ff081fcc1421a7d5adc30c161879

                                                  SHA512

                                                  2a6d7064ca991ae73034b214ae9255090aaa696446baab36e4151e62f5636af8adf7252c5b1158795f971850c78a83f026e1c8b7c3452b4833d71c572f24a5af

                                                • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                                                  Filesize

                                                  1024KB

                                                  MD5

                                                  51da34a4f22540e7676f7e66bbb3d544

                                                  SHA1

                                                  963a8594079797affc9f8761097d2923fbdaaa79

                                                  SHA256

                                                  9f28ece875b6bbe68f45aa53fc6d82f4891ba8112988e67c9d09c564ff6fced6

                                                  SHA512

                                                  33cc454adcbf59703a93e68a0523ff49a6e5dea120cfb16f4e5b74417b0bff426e8cf6c6adca7cc92c2a7f65ce626e7eece84b8f3f5c4199afce2a7a6c6f524f

                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

                                                  Filesize

                                                  24B

                                                  MD5

                                                  b9bd716de6739e51c620f2086f9c31e4

                                                  SHA1

                                                  9733d94607a3cba277e567af584510edd9febf62

                                                  SHA256

                                                  7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                  SHA512

                                                  cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                  Filesize

                                                  648KB

                                                  MD5

                                                  b06d6e8e5126e84e290a95f9fc8b75f6

                                                  SHA1

                                                  8fe644d05d1226f1f3cb28d21558e04b42fa4481

                                                  SHA256

                                                  27085a5206eb9873d6c410f4405ae0ac427a94d6b5563dbc4dd6bfc660091b4a

                                                  SHA512

                                                  bc5b87a7b5134c3bf878fde3b922cb6390704bd97beae94ac573b0ade398eb835f5b32109d78dec33e5c8365912ba76f9d5c480a19e88b6f1f9a0212c2998ee5

                                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                  Filesize

                                                  872KB

                                                  MD5

                                                  41a610a1f303b59e35f8da7c63c8e79d

                                                  SHA1

                                                  184111bbbd3a7f16fb6bbd8bee46cb7555a0dcf6

                                                  SHA256

                                                  23a7da8bfb1fa95869c41f40302daac308683206b82611cdd29e3a2f1f9a4c21

                                                  SHA512

                                                  d4531a46e3f0ed50f07c4dccfa6a9c88c6ff94714bdc05a43f7fb67bdb810877e85301305d534e2da93e68d529d9cb957f5f44dfb7d1000e99053b2f8afb3258

                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                  Filesize

                                                  678KB

                                                  MD5

                                                  0109f59ba2ad138ece46d98a9ac4c51a

                                                  SHA1

                                                  9086587ebc33fae918d7c71f70aa44be0f4bd253

                                                  SHA256

                                                  d488edb52498cd5a08882ae2230e331ace8ff561abb2a968d859123c37f726b5

                                                  SHA512

                                                  32de0e367c679794dbfc6f2c0b70ae2786087da5be12d78b47e757055409d62652cd75f56d97fbd6164169f3a27cd1cb870baebbd9fe90fbcdc70ef8dbdacdab

                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  7edd90afc437e69a178074f52d03c282

                                                  SHA1

                                                  7deb71f38b5ba79676550f27880be332ce438e36

                                                  SHA256

                                                  6e4a535ab7f146940acd8d0e7da49d0fd35b045ed4c325b7c809f94680010505

                                                  SHA512

                                                  8d3487220ccc9753f0ae01e3076504570e4f4334dbe57a0883e11d75ec53d61c0ae674bcae5f9034c992246dfa3e6ea0f6b91a40ad56dab5e93c008f160a48c5

                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                  Filesize

                                                  625KB

                                                  MD5

                                                  22c11b35b02b9f283447b8ac4e957684

                                                  SHA1

                                                  4f89cb5fe94202eab988cf9d6feba7e197b0b026

                                                  SHA256

                                                  d5fe1e444e4c392f01581c2de3541129be57a3b1d65f35cb777bba4f65336ee1

                                                  SHA512

                                                  c504f0a91240e913132eea02ff300b26e75ba08c13e7352399ba3ebe44f65d7a7a64da9d0753e2498a4d47c6845c71314c5cc8465d5d2cec3dc03bd2f288875b

                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                  Filesize

                                                  1003KB

                                                  MD5

                                                  e95f1a66bdabca4eed2f3b5de366584e

                                                  SHA1

                                                  e4fc12291256ced337044f04ca642af8be612c9d

                                                  SHA256

                                                  5a4b21eddf5757898d8acb55aee66cae0b39f7e8dca4a8c085f5c7db25625335

                                                  SHA512

                                                  05249d757ea7e9a93088660ddf20909310adb675976612f3f30fb2c92ff8fd217d3ec482657a9a244b78ca1256c26e1250e4ec939fc6c191cd23c30b051f3321

                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                  Filesize

                                                  656KB

                                                  MD5

                                                  4c3020daac09c93c6ae32f5fa473d5f4

                                                  SHA1

                                                  9275a54d129b5128844f80bded3fa732bec76da4

                                                  SHA256

                                                  e57ac5a79e8ce18d5309e1185841907d1a017dab9d72ddbcc8725009396768b5

                                                  SHA512

                                                  e19600444f47cadf5caef7fea18db6ef2658f20f139996332d177020025ef581e8791438ca9745dab88177d8db70889737b1bb3acecca965c3147bee5f174f18

                                                • C:\Windows\SysWOW64\perfhost.exe

                                                  Filesize

                                                  587KB

                                                  MD5

                                                  719feb8a1a83a2bc42af5ce27d17c37a

                                                  SHA1

                                                  666b554e25f37e98c77924d76d0787f40db54b92

                                                  SHA256

                                                  1abb67a6cc42dd98a4c9712ae5d35d9bb2baa82e9cc1a01b1bfa75b84092a709

                                                  SHA512

                                                  64488c72920731f403cc47abe860556c280f53c2234ab490e697e6ae88a5bdca97ccc5defa080bb05c4af4173ce5c2d012a3115d29dadfb50c9f30e0d66bf99c

                                                • C:\Windows\System32\Locator.exe

                                                  Filesize

                                                  577KB

                                                  MD5

                                                  e20784cc92c60918c4c0d8e5227fb63b

                                                  SHA1

                                                  e9296be93919497443023768559d9f63c416a23a

                                                  SHA256

                                                  b8e53fc0bf3bbb8f1940e1ce5e888172161f21e0a5939fd731d65a4b9889157c

                                                  SHA512

                                                  315677843a9fe29c76a69ac8646bd679e62ac7aaa4b7e1ae4a1c3f54605c115964a11f1d253b194b300e0e4a1c1bba365b98eb44b45d30de9ad5e357ec9eb0d3

                                                • C:\Windows\System32\vds.exe

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  a4dd0bc707afb4b9eb78546fb6499be9

                                                  SHA1

                                                  f0a25e9d25ee39396219d9dfc94ad90263157e5a

                                                  SHA256

                                                  11fe5ce6333c641ea2e07353157f3f390d947f2daae5cff2fd3e22c4af05861c

                                                  SHA512

                                                  b5d3976e0eceda3fb2d2ccfb3980caaf115e60847d4f6ffb2b517ed6a10edc7e03fc9ffa6498917c24038f3ee19a99e114049711993c6619212b446cf8dc3367

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

                                                  Filesize

                                                  248KB

                                                  MD5

                                                  4bbf44ea6ee52d7af8e58ea9c0caa120

                                                  SHA1

                                                  f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                  SHA256

                                                  c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                  SHA512

                                                  c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

                                                  Filesize

                                                  58KB

                                                  MD5

                                                  3d6987fc36386537669f2450761cdd9d

                                                  SHA1

                                                  7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                  SHA256

                                                  34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                  SHA512

                                                  1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

                                                  Filesize

                                                  205KB

                                                  MD5

                                                  0a41e63195a60814fe770be368b4992f

                                                  SHA1

                                                  d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                  SHA256

                                                  4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                  SHA512

                                                  1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                  Filesize

                                                  43KB

                                                  MD5

                                                  68c51bcdc03e97a119431061273f045a

                                                  SHA1

                                                  6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                  SHA256

                                                  4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                  SHA512

                                                  d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                  Filesize

                                                  198KB

                                                  MD5

                                                  9d9305a1998234e5a8f7047e1d8c0efe

                                                  SHA1

                                                  ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                  SHA256

                                                  469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                  SHA512

                                                  58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\3a0ae44e04afc93ffd5e2af53a25d0da\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

                                                  Filesize

                                                  305KB

                                                  MD5

                                                  7c3766bfc5671320fca985a9e95e7344

                                                  SHA1

                                                  a3735515e4395d51e4027b2148f4811ccaa7b543

                                                  SHA256

                                                  ddef847dad87b5e96054ce3d1482d611778a5422e0e78e2648fdf5d3d4be4978

                                                  SHA512

                                                  a21b9d115892e759e924b665e8570a474fa198b24acb249d93e10d03488cc6361d2b31f5f6d2efd27bf0b98b42e18c90aa9687208b917d7fac5cbbb4f009fd63

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\468e29a55405b9e85a203267372afe6a\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                  Filesize

                                                  221KB

                                                  MD5

                                                  405848e86695192fba192c131b3946cc

                                                  SHA1

                                                  92e1c3a6c4de1d5810f97e721e5cc7d72f2ec27b

                                                  SHA256

                                                  143157f8231d3bd72e03ac69f466f19bdfb68984da97f993946b895de562bb0b

                                                  SHA512

                                                  e8473a31bb78727d2ae57cadc4c53c184e8092e7b29174024b3ee0a442a13265f781f3b3ccd246122a2e9f80ddbf6c55d9b41349e46ba4384c80a29c5f83a404

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                  Filesize

                                                  70KB

                                                  MD5

                                                  57b601497b76f8cd4f0486d8c8bf918e

                                                  SHA1

                                                  da797c446d4ca5a328f6322219f14efe90a5be54

                                                  SHA256

                                                  1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                  SHA512

                                                  1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77c2c41b385e1e597e216225b4dc2145\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                  Filesize

                                                  271KB

                                                  MD5

                                                  6b3bb4b643cb779940cc0b1adea870ee

                                                  SHA1

                                                  bdd98c52d0521a394900d3af7ca1e7d8865fa96c

                                                  SHA256

                                                  2ca6a97186c24d8fd7a9f719190d713d8598b2ed3c32069eb5d837ba4c013f76

                                                  SHA512

                                                  f2585094e372392356ed82088b34cac20759d6174efe3b2c8c95dbcdbde70b226e8565ec76207ec8dd2eeb5670d6037b7385436087b5ef01e33a727412eb71b8

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

                                                  Filesize

                                                  87KB

                                                  MD5

                                                  ed5c3f3402e320a8b4c6a33245a687d1

                                                  SHA1

                                                  4da11c966616583a817e98f7ee6fce6cde381dae

                                                  SHA256

                                                  b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                  SHA512

                                                  d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                  Filesize

                                                  82KB

                                                  MD5

                                                  2eeeff61d87428ae7a2e651822adfdc4

                                                  SHA1

                                                  66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                  SHA256

                                                  37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                  SHA512

                                                  cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

                                                  Filesize

                                                  58KB

                                                  MD5

                                                  a8b651d9ae89d5e790ab8357edebbffe

                                                  SHA1

                                                  500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                  SHA256

                                                  1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                  SHA512

                                                  b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

                                                  Filesize

                                                  85KB

                                                  MD5

                                                  5180107f98e16bdca63e67e7e3169d22

                                                  SHA1

                                                  dd2e82756dcda2f5a82125c4d743b4349955068d

                                                  SHA256

                                                  d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                  SHA512

                                                  27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\c87d866fd7c61399edca08521bdefb29\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                  Filesize

                                                  122KB

                                                  MD5

                                                  1291737c225cd37792ed0c7aa0e2af9c

                                                  SHA1

                                                  f8040ef748df4930f712b5a42c59762ff7986c6f

                                                  SHA256

                                                  937b16dd497967d0ce6be4bd7555fa48f9ace0738a88578f666c1527f43cc8b5

                                                  SHA512

                                                  85d2051d6eb64ecb00eccac452b3717302cae811dd0f1b4003b5a3b1c68046e35b458a70620a166661894d31ec1a894862152db5f36ad448b3edea8a1155278a

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

                                                  Filesize

                                                  298KB

                                                  MD5

                                                  5fd34a21f44ccbeda1bf502aa162a96a

                                                  SHA1

                                                  1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                  SHA256

                                                  5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                  SHA512

                                                  58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                  Filesize

                                                  43KB

                                                  MD5

                                                  dd1dfa421035fdfb6fd96d301a8c3d96

                                                  SHA1

                                                  d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                  SHA256

                                                  f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                  SHA512

                                                  8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                • C:\Windows\system32\fxssvc.exe

                                                  Filesize

                                                  1.2MB

                                                  MD5

                                                  a79467f398f410101c0f564696b03793

                                                  SHA1

                                                  6f36df24742bd071b30301d1c96dcdd5d42f1498

                                                  SHA256

                                                  9c252fdb8f64e14ce6195a43046ed3e2ee2508a5562a6086cae8172449e0f311

                                                  SHA512

                                                  28edbcc56b0f5464c50b6628739c569ad4b1440234ecb8e8939eafaae50855354633d06eefdf474ffebc5dd81b2c107deec4daf16039c22c9d8f18936cb318f7

                                                • C:\Windows\system32\vssvc.exe

                                                  Filesize

                                                  2.1MB

                                                  MD5

                                                  fbb166ee6061fc590c781da078377d41

                                                  SHA1

                                                  bf4fa2be1a2f51564594ca00eb5520999d7bc5e6

                                                  SHA256

                                                  474644219c455c30afb8b0663fdea3b0b8b1509da7104ef2e6cddb3fef38672d

                                                  SHA512

                                                  8d52e492ee30bc798fb579c34acecb33c408f6c9be44944f59a1fef31312025358c5a951f41a3dd46ab43082684e3668e2435543ae563d2ce6cb54da05b4cc77

                                                • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                                  Filesize

                                                  603KB

                                                  MD5

                                                  7688ed26546cf7025ce699687e264292

                                                  SHA1

                                                  ff09bdc6437ed00a31dd9ddf9e3702d0e696c8c5

                                                  SHA256

                                                  457d4711ee76df9b2a2a7bda4f009e69b628b08f4b2a458e221159d43fc33874

                                                  SHA512

                                                  b9762c0503dfc9665d1fd608dbca9da73f4fa050d4fa9c2a2ba699020140f24588912a362a79bd6671c538e50dec2132af8638556e6e4ac34d5c9035d929dc6b

                                                • \Windows\System32\alg.exe

                                                  Filesize

                                                  644KB

                                                  MD5

                                                  4f178d5489ec22f76ee8fed3f0a183ce

                                                  SHA1

                                                  aa0b5940f2ec393994399481db73e1b8046eb3bd

                                                  SHA256

                                                  94355f4261d3db5219773fe49c14bd2e4d52381c7c5cd9ea41654d84514e5960

                                                  SHA512

                                                  51ee1fc9337e738e0bde453c948095383a76a7687fdf46375462bee0d98b47f1ba0ea119b7943e754ea2b24dfb4fbdcab349cdd4f820a6722987e4e8d9dd1574

                                                • \Windows\System32\ieetwcollector.exe

                                                  Filesize

                                                  674KB

                                                  MD5

                                                  5eaa4999b0dbfddc7aa864e03b9b28eb

                                                  SHA1

                                                  70a310af4a8f11b1cc902aa22e1923dccfecca80

                                                  SHA256

                                                  38f2bc379c7b5e72f5e609097229f89aff9f3c51dc1469a3a7c6aa89f1617e7c

                                                  SHA512

                                                  6ed4e7b3e6eebfa6d1f550641e0494c2f0e7b5e695106099ca04097b0d8fe7ead0d24e79e1bc4587d8150341a120b4236d16c94fb1242fd41c4ee6c3b9c94822

                                                • \Windows\System32\msdtc.exe

                                                  Filesize

                                                  705KB

                                                  MD5

                                                  8816803935110e05728e652b507acd2f

                                                  SHA1

                                                  a96233c580ede074b54964b1837e8f8c5ab49bc0

                                                  SHA256

                                                  75299d7858ede33bcef84269c4c16f5391a5f4722d142b818bb043208ceb589f

                                                  SHA512

                                                  56e4f00a77bd1993a4754f54ec63af42d875e2ac03ffe20279ca6e2fa7a6beefc96ade2f6f6077e7b30c04708825c26b08846c5ea9035c673417c8accf6fd685

                                                • \Windows\System32\msiexec.exe

                                                  Filesize

                                                  691KB

                                                  MD5

                                                  2ad1524a0b7dfcfba19aebbeb2053452

                                                  SHA1

                                                  bf648028075680e05a9c3134c0956b0a197c3716

                                                  SHA256

                                                  26db94eed386180d9c4111f8786f80511c081d1e38ad9cc56ae24aab2995bee8

                                                  SHA512

                                                  49b715bdf429f6d514e3409f53abfcaf471f151ccc88602ebe9e6b5be5768c2baa96e98435ec0e2c0748fe1a31082a5c517c800a2ea0c1ac36c6e91ce1ba3c2d

                                                • \Windows\System32\snmptrap.exe

                                                  Filesize

                                                  581KB

                                                  MD5

                                                  2d6935a7f371d71fa68d083ad4fdb323

                                                  SHA1

                                                  61298e0f47251ffb2462d436433492cd879ad0ad

                                                  SHA256

                                                  f7ac4d3d2396f102a555c37bf28dc8ca480152b9f514b922ac0743c67b6918ed

                                                  SHA512

                                                  c9e3da175bfc94e5ce49afb5209bdfa9dc0fde3424be76a22d12d52d68346da9089a476a7fbbe8b858fc6801bb93b70582310ef674bfc1fcc32ea9e3f24ad7a1

                                                • \Windows\ehome\ehrecvr.exe

                                                  Filesize

                                                  1.2MB

                                                  MD5

                                                  448488be326076e2d0030ef108d7f981

                                                  SHA1

                                                  f05eeef6f2491f7239da38b449f58c424df0068a

                                                  SHA256

                                                  a438d216d41e9bb9cfc8ec722254a7ec559a5234abd1f8c37df2cf31840f7d80

                                                  SHA512

                                                  b64a19df33d6934a9ff75d800e2c07478802223e47bd11ecf40e27a66c8581a51d77b1519cce6a453f1caef95b64036f65d5c465e211ba12fdb51e3fa708bc10

                                                • \Windows\ehome\ehsched.exe

                                                  Filesize

                                                  691KB

                                                  MD5

                                                  705029dd91dfec15b2874a62dc7afdd4

                                                  SHA1

                                                  9cf365986761f37f74b7bd3c8f1932b3af994bb6

                                                  SHA256

                                                  7a38e8b5f26e94f73167e66f53bf2f5af75155a0099b7884ef2edc564fba7700

                                                  SHA512

                                                  b94dad0d6b5e90ed4631cf76e59c235698c40eb6571cd4cf5fea19f118b3190a9c5da4754e1c5c3d364bdcfd9df3f696726082a55c414eada2dd0b4672268a7e

                                                • memory/612-636-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/612-615-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/696-539-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/696-565-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/780-22-0x0000000000830000-0x0000000000890000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/780-110-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                  Filesize

                                                  656KB

                                                • memory/780-14-0x0000000000830000-0x0000000000890000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/780-13-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                  Filesize

                                                  656KB

                                                • memory/840-7-0x0000000001C40000-0x0000000001CA0000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/840-3-0x0000000140000000-0x00000001400DD000-memory.dmp

                                                  Filesize

                                                  884KB

                                                • memory/840-74-0x0000000140000000-0x00000001400DD000-memory.dmp

                                                  Filesize

                                                  884KB

                                                • memory/840-311-0x0000000001C40000-0x0000000001CA0000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/840-0-0x0000000001C40000-0x0000000001CA0000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/840-309-0x0000000140000000-0x00000001400DD000-memory.dmp

                                                  Filesize

                                                  884KB

                                                • memory/920-755-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/920-752-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/972-761-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/972-237-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/972-151-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/1000-428-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/1000-446-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/1052-797-0x0000000100000000-0x000000010020A000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                • memory/1100-247-0x0000000001000000-0x0000000001096000-memory.dmp

                                                  Filesize

                                                  600KB

                                                • memory/1100-435-0x0000000001000000-0x0000000001096000-memory.dmp

                                                  Filesize

                                                  600KB

                                                • memory/1108-289-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/1108-327-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/1184-665-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/1184-685-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/1312-766-0x0000000140000000-0x000000014013C000-memory.dmp

                                                  Filesize

                                                  1.2MB

                                                • memory/1312-204-0x0000000140000000-0x000000014013C000-memory.dmp

                                                  Filesize

                                                  1.2MB

                                                • memory/1312-111-0x0000000140000000-0x000000014013C000-memory.dmp

                                                  Filesize

                                                  1.2MB

                                                • memory/1600-696-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/1632-729-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/1660-898-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                  Filesize

                                                  784KB

                                                • memory/1660-779-0x0000000100000000-0x00000001000C4000-memory.dmp

                                                  Filesize

                                                  784KB

                                                • memory/1672-552-0x0000000100000000-0x0000000100114000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1672-297-0x0000000100000000-0x0000000100114000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1708-214-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                  Filesize

                                                  712KB

                                                • memory/1708-322-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                  Filesize

                                                  712KB

                                                • memory/1708-340-0x0000000000590000-0x0000000000642000-memory.dmp

                                                  Filesize

                                                  712KB

                                                • memory/1708-216-0x0000000000590000-0x0000000000642000-memory.dmp

                                                  Filesize

                                                  712KB

                                                • memory/1756-181-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                  Filesize

                                                  808KB

                                                • memory/1756-199-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                  Filesize

                                                  808KB

                                                • memory/1768-124-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                  Filesize

                                                  712KB

                                                • memory/1768-758-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                  Filesize

                                                  712KB

                                                • memory/1768-215-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                  Filesize

                                                  712KB

                                                • memory/2064-266-0x0000000100000000-0x0000000100095000-memory.dmp

                                                  Filesize

                                                  596KB

                                                • memory/2064-477-0x0000000100000000-0x0000000100095000-memory.dmp

                                                  Filesize

                                                  596KB

                                                • memory/2092-493-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2092-436-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2108-195-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2108-76-0x0000000000A10000-0x0000000000A77000-memory.dmp

                                                  Filesize

                                                  412KB

                                                • memory/2108-81-0x0000000000A10000-0x0000000000A77000-memory.dmp

                                                  Filesize

                                                  412KB

                                                • memory/2108-75-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2164-170-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                  Filesize

                                                  30.1MB

                                                • memory/2164-242-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                  Filesize

                                                  30.1MB

                                                • memory/2184-659-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2324-588-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2332-514-0x0000000100000000-0x0000000100096000-memory.dmp

                                                  Filesize

                                                  600KB

                                                • memory/2332-272-0x0000000100000000-0x0000000100096000-memory.dmp

                                                  Filesize

                                                  600KB

                                                • memory/2376-598-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2376-613-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2392-270-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                  Filesize

                                                  728KB

                                                • memory/2392-185-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                  Filesize

                                                  728KB

                                                • memory/2424-769-0x0000000100000000-0x0000000100202000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                • memory/2424-897-0x0000000100000000-0x0000000100202000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                • memory/2500-544-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2500-516-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2500-733-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2532-751-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2576-221-0x0000000140000000-0x0000000140237000-memory.dmp

                                                  Filesize

                                                  2.2MB

                                                • memory/2576-139-0x0000000140000000-0x0000000140237000-memory.dmp

                                                  Filesize

                                                  2.2MB

                                                • memory/2592-56-0x0000000000210000-0x0000000000270000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/2592-62-0x0000000000210000-0x0000000000270000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/2592-63-0x0000000000210000-0x0000000000270000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/2592-104-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                  Filesize

                                                  668KB

                                                • memory/2592-55-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                  Filesize

                                                  668KB

                                                • memory/2600-664-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2600-660-0x0000000003C00000-0x0000000003CBA000-memory.dmp

                                                  Filesize

                                                  744KB

                                                • memory/2600-656-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2716-577-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2716-566-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2752-295-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/2752-228-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/2764-799-0x0000000100000000-0x0000000100123000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2812-243-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                  Filesize

                                                  724KB

                                                • memory/2812-422-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                  Filesize

                                                  724KB

                                                • memory/2824-39-0x0000000010000000-0x000000001009F000-memory.dmp

                                                  Filesize

                                                  636KB

                                                • memory/2824-69-0x0000000010000000-0x000000001009F000-memory.dmp

                                                  Filesize

                                                  636KB

                                                • memory/2824-45-0x0000000000230000-0x0000000000297000-memory.dmp

                                                  Filesize

                                                  412KB

                                                • memory/2824-40-0x0000000000230000-0x0000000000297000-memory.dmp

                                                  Filesize

                                                  412KB

                                                • memory/2836-36-0x0000000000870000-0x00000000008D0000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/2836-138-0x0000000140000000-0x000000014009D000-memory.dmp

                                                  Filesize

                                                  628KB

                                                • memory/2836-27-0x0000000140000000-0x000000014009D000-memory.dmp

                                                  Filesize

                                                  628KB

                                                • memory/2836-28-0x0000000000870000-0x00000000008D0000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/2868-601-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2896-640-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2924-716-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2948-519-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2948-495-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2960-707-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2984-341-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/2984-433-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB

                                                • memory/3052-92-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/3052-99-0x0000000000400000-0x0000000000460000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/3052-93-0x0000000000400000-0x0000000000460000-memory.dmp

                                                  Filesize

                                                  384KB

                                                • memory/3052-200-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                  Filesize

                                                  696KB

                                                • memory/3064-618-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                  Filesize

                                                  672KB