Overview

overview

7

Static

static

3

2024-12-21...uk.exe

windows7-x64

7

2024-12-21...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/12/2024, 14:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-21_a4f39384d2cb9e26f095cf92b213bc41_ryuk.exe

  • Size

    1.1MB

  • MD5

    a4f39384d2cb9e26f095cf92b213bc41

  • SHA1

    9c5de5a1c74020c32ab9cd19cf8a5ce20ea709c9

  • SHA256

    044336179d22626a43ae59639c3c8ce83f5ed24b4a7dc28888b5829585f9a840

  • SHA512

    ae09e4a70ac1e634c4d7f8c2d09f122cfd5e1453f725907bcc540829236504a1499f030c688246cd5b0b7ba1dac30e0d996a2857aba9063dd34798ddde0ab9d6

  • SSDEEP

    24576:7Si1SoCU5qJSr1eWPSCsP0MugC6eTOsqjnhMgeiCl7G0nehbGZpbD:7S7PLjeTiDmg27RnWGj

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-21_a4f39384d2cb9e26f095cf92b213bc41_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-21_a4f39384d2cb9e26f095cf92b213bc41_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:844
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2800
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2856
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2592
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:636
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2560
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 254 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2132
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 260 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 24c -NGENProcess 244 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 250 -NGENProcess 268 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1332
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1f0 -NGENProcess 244 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2860
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 26c -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 268 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:648
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 250 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 250 -NGENProcess 244 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 280 -NGENProcess 260 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1d8 -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1712
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 284 -NGENProcess 1f0 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 260 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1512
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1d8 -NGENProcess 290 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1744
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 268 -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1840
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 294 -NGENProcess 288 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 290 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 260 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:648
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 2a0 -NGENProcess 294 -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 28c -NGENProcess 260 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 260 -NGENProcess 288 -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 260 -NGENProcess 1f0 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:980
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 2d0 -NGENProcess 2a0 -Pipe 2cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2136
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d4 -NGENProcess 2c0 -Pipe 2c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2528
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2d8 -NGENProcess 1f0 -Pipe 2bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2672
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2dc -NGENProcess 2a0 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1228
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 1f0 -NGENProcess 2a0 -Pipe 2d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1852
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 2e8 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2508
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2e0 -NGENProcess 2dc -Pipe 2a4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2f0 -NGENProcess 2a0 -Pipe 2c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:700
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2a0 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2f8 -NGENProcess 2dc -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2dc -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 300 -NGENProcess 2e8 -Pipe 2e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2776
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2e8 -NGENProcess 2f8 -Pipe 2fc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 308 -NGENProcess 2f0 -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3028
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2f0 -NGENProcess 300 -Pipe 304 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2528
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 310 -NGENProcess 2f8 -Pipe 2dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2672
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2f8 -NGENProcess 308 -Pipe 30c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 318 -NGENProcess 300 -Pipe 2e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 300 -NGENProcess 310 -Pipe 314 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1172
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 320 -NGENProcess 308 -Pipe 2f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2316
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 308 -NGENProcess 318 -Pipe 31c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 328 -NGENProcess 310 -Pipe 2f8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:772
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 310 -NGENProcess 320 -Pipe 324 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:236
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 330 -NGENProcess 318 -Pipe 300 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2320
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 318 -NGENProcess 328 -Pipe 32c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 338 -NGENProcess 320 -Pipe 308 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1504
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 320 -NGENProcess 334 -Pipe 318 -Comment "NGen Worker Process"
      2⤵
        PID:1536
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 340 -NGENProcess 328 -Pipe 310 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1508
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 328 -NGENProcess 338 -Pipe 33c -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2372
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 348 -NGENProcess 334 -Pipe 330 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1332
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 334 -NGENProcess 340 -Pipe 344 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1916
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 350 -NGENProcess 338 -Pipe 320 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2416
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 338 -NGENProcess 348 -Pipe 34c -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:884
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 358 -NGENProcess 340 -Pipe 328 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2756
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 340 -NGENProcess 350 -Pipe 354 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:2348
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 208 -NGENProcess 2d4 -Pipe 348 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2136
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 260 -NGENProcess 340 -Pipe 338 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2828
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 350 -NGENProcess 334 -Pipe 2c4 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:904
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 364 -NGENProcess 2d4 -Pipe 20c -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2260
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 2d4 -NGENProcess 260 -Pipe 340 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2676
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 260 -NGENProcess 360 -Pipe 334 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2400
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 370 -NGENProcess 368 -Pipe 208 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2640
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 36c -Pipe 350 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:2860
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 360 -Pipe 364 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2416
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 368 -Pipe 358 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3032
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 36c -Pipe 2d4 -Comment "NGen Worker Process"
        2⤵
          PID:2668
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 360 -Pipe 260 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2344
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 368 -Pipe 370 -Comment "NGen Worker Process"
          2⤵
            PID:2700
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 36c -Pipe 374 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1624
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 360 -Pipe 378 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2076
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 368 -Pipe 37c -Comment "NGen Worker Process"
            2⤵
              PID:1136
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 36c -Pipe 380 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1696
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 360 -Pipe 384 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2008
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 368 -Pipe 388 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1564
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 36c -Pipe 38c -Comment "NGen Worker Process"
              2⤵
                PID:2284
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 360 -Pipe 390 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:2716
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 368 -Pipe 394 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:960
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 36c -Pipe 398 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1660
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 360 -Pipe 39c -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3068
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 368 -Pipe 3a0 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2060
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3a4 -Pipe 3b4 -Comment "NGen Worker Process"
                2⤵
                  PID:1968
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 360 -Pipe 3a8 -Comment "NGen Worker Process"
                  2⤵
                    PID:1572
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 368 -Pipe 3ac -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:772
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3a4 -Pipe 3b0 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:2880
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 360 -Pipe 36c -Comment "NGen Worker Process"
                    2⤵
                    • Modifies data under HKEY_USERS
                    PID:2512
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 368 -Pipe 3b8 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:2308
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3dc -NGENProcess 3a4 -Pipe 3d8 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:1720
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3a4 -NGENProcess 3dc -Pipe 3e0 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:1808
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3e4 -NGENProcess 368 -Pipe 3c4 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:364
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3d4 -Pipe 3c8 -Comment "NGen Worker Process"
                    2⤵
                      PID:972
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 3dc -Pipe 3cc -Comment "NGen Worker Process"
                      2⤵
                        PID:2788
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      1⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2660
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
                        2⤵
                        • Executes dropped EXE
                        PID:2568
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 238 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
                        2⤵
                        • Executes dropped EXE
                        PID:2384
                    • C:\Windows\ehome\ehRecvr.exe
                      C:\Windows\ehome\ehRecvr.exe
                      1⤵
                      • Executes dropped EXE
                      PID:832
                    • C:\Windows\ehome\ehsched.exe
                      C:\Windows\ehome\ehsched.exe
                      1⤵
                      • Executes dropped EXE
                      PID:548
                    • C:\Windows\eHome\EhTray.exe
                      "C:\Windows\eHome\EhTray.exe" /nav:-2
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:1928
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:2312
                    • C:\Windows\ehome\ehRec.exe
                      C:\Windows\ehome\ehRec.exe -Embedding
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:976
                    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                      "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                      1⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      PID:1496
                    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                      1⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      PID:1804
                    • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                      "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                      1⤵
                      • Executes dropped EXE
                      PID:1248

                    Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
                            Filesize

                            1.3MB

                            MD5

                            531e08d3e9d6cc6e8b1619c1f8d366cc

                            SHA1

                            d67032fe52e372692960ac968e092e1631a62fe4

                            SHA256

                            a6d03af003fff0c3a1ad1c2920f4179edec7aa801d3a47b98cb8eb0a44faa37c

                            SHA512

                            b99f0e35f82872c8ebb8fa0ae81f1cca4d4729be1214452b00a25e0a4f60233a4145a3ce3e663aef9b36385d7073de638faa710a57d453d1984f33665f00cd3d

                            Download Submit

                          • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
                            Filesize

                            1.6MB

                            MD5

                            37d4852cab86b70a37da7238162ce1c7

                            SHA1

                            62cb9b288a323ee3ac9161cc715937184cc1d5e3

                            SHA256

                            9edaa4767e51ad97c0936e3ac3f38d2a60d88fd669be02ea636427b66ba60396

                            SHA512

                            c33762b619941151cebaaa9a403ed0fb1a137fa0e37a1880d02950f13afdef2ffc7b3ad31dd67d7de7dbb363d819471e3dc4b6b50c37fefae0337a330d656512

                            Download Submit

                          • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
                            Filesize

                            1.3MB

                            MD5

                            c7e6c49df07bebc02befd811bf738513

                            SHA1

                            1a3f1d3f77c5f2f59e43e1d6c143375bde2d86fb

                            SHA256

                            bfe397633740f61d2c7e16929d60a3fd8facadb3f94549ead4662ebedf0e4f38

                            SHA512

                            e39abce1b6b7ab72e4a893d922e2279db3529091cd9e9925e7549100c35e099b799279ef56c14d81f80b743af7308c749590813d49578988a4ca4ddd73b9dd61

                            Download Submit

                          • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
                            Filesize

                            1.7MB

                            MD5

                            f9433ab83ee0e5b6f4574005bb8d9e13

                            SHA1

                            7fe5d8cf677a7c01508ec5f0a217af635e98305a

                            SHA256

                            f62ebbe49e144d4f8e2c7642ef4b9d01a3b3c3ec5bf008b3069a308d2745635c

                            SHA512

                            0bd88996c434551709800f53564c796fe9dd656b12d09b0deeabd9280b1cf1194a795ca5bd673a5f2236c59404544c3aeb3d4b5eff890d80b21d42878c6cebd4

                            Download Submit

                          • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                            Filesize

                            1.3MB

                            MD5

                            d78bc0cb4fe23eafd216f006ba8b1711

                            SHA1

                            e6221722af0188493462c7f2ac24aca566f860d2

                            SHA256

                            014f08ff721079c91dc549b94e040b22beed57bc0d4b19a8be82b86dd71fdc1c

                            SHA512

                            79b7850421d6bde5ad99673d20a54dc6980426cf1f0a4bbcde79eeb21a0ae72923ccce715a29cb15acd1d1ce1eee8b80bbc25bc3f9198d192d31ff72060a18ee

                            Download Submit

                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                            Filesize

                            30.1MB

                            MD5

                            9a77c4658e7f56739879dc1a019f0034

                            SHA1

                            f02a21ba7531e707009bbf572ad6c71cb978e252

                            SHA256

                            49c49bfa311948a66d0659a486354c57bba6c64faa08ac20e2debb93419d4fd4

                            SHA512

                            24af071dc935a99ab5acb8e3a4c66d20d5b408a9350cfa00fac0303b669e4c9a58548dc332da10d17c257387838f1da55435b747c51319bef45772b322802f82

                            Download Submit

                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                            Filesize

                            1.4MB

                            MD5

                            618f1c48c30086e2ebed9b97994799e5

                            SHA1

                            9698d323a378e7dc48993bb96599c1145c73abc6

                            SHA256

                            07fc6014a35903315c7c5ffd41d9105754d72235b066de2bddca3359171b23f8

                            SHA512

                            0f440a5e9139a8032bd5fdf685b024b25eea2b4af030cf79c76a1a44082e1aa6f62823a85c1b93514ad8f0544fe1b39482ff9eb12e24d82b7593ae35cad7b9d8

                            Download Submit

                          • C:\Program Files\7-Zip\7z.exe
                            Filesize

                            1.7MB

                            MD5

                            daf6043b71728e3fd9308e8b205ac654

                            SHA1

                            8f8907c8b3ba2e45523988dfb381fa73093413d4

                            SHA256

                            8a02896c73335257aeac2b52ebf63511c82f87c62d00e23b5d6c1431184ba11f

                            SHA512

                            ea859f7116f1af386e1855959ef0f83553c589247f1250edc32a5d9411bf9b1e9b3b89ccba7a6ee4af2487e3299ffd27cf4498f84226eaa6b706b9dacc24e3b4

                            Download Submit

                          • C:\Program Files\7-Zip\7zFM.exe
                            Filesize

                            1.5MB

                            MD5

                            780cf118a3f2a181d152203058df93d9

                            SHA1

                            e5e4e357e47d89c44bd1f992bc8c4e418312d31a

                            SHA256

                            b0ec056d87deaa349b9c63c738b568505ef8695af6fe478081b7dfc54371c69d

                            SHA512

                            ea80bab5eea83a07f2b21b1fe35323de24cd93b61d3710f91b19c88044363b5f27c93c5ea3a8bac114b96f8bc9040343cbfbfd5aae71205a88ec03018da64d41

                            Download Submit

                          • C:\Program Files\7-Zip\7zG.exe
                            Filesize

                            1.2MB

                            MD5

                            9387627f846988c14ffab8d75eb7cea9

                            SHA1

                            6d646b6d91bb6fe67e8bc0230c82be8c2c752b3e

                            SHA256

                            b94fe3b8041d4e0a21f904293336fff062d7e6b81520ea8127a37003241440ea

                            SHA512

                            0d9e3fff4e05c7de6e42ab1042d7054431170fb893b4ae3189d40be97b2ab0f61e94aafd76c7dc6cf481dd405eaa87c7a25bd161a11acfd3c170153707c3c567

                            Download Submit

                          • C:\Program Files\7-Zip\Uninstall.exe
                            Filesize

                            1.2MB

                            MD5

                            9ac839e3db87e42ffddac6cff7d7f7c3

                            SHA1

                            166f857d6f8c18984c07a3b243ef34d834eea701

                            SHA256

                            83623dcea909eb90f9636e1fb5c5a8e677baf7be940faf229aa94400a1911a8a

                            SHA512

                            e748abaab270efe4cd87977e58821286f9e057db233e1a5d00d7d95df0adf1f400331162c415ecf01ac0d185e68b7248d1c01491d5683e99233b9d8a387faf63

                            Download Submit

                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                            Filesize

                            4.8MB

                            MD5

                            2051db344f1049187995c2955a9113a5

                            SHA1

                            d54cb34fa4285268197c75a5933fe4610f81e3a4

                            SHA256

                            667f9f4222f54539bf8329968e4ae0ecdffc38e3b1db36ffb495ea41554a3b69

                            SHA512

                            d60f2b18af323865aa4d18ff217b62b91f937cd3b2d2595fba0218f4e12ec6969b510d15295bca19e3e8f81020d04a62e8ebed4e351b7868e98cf5f00d454e80

                            Download Submit

                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                            Filesize

                            4.8MB

                            MD5

                            36849e599e49beeb1734073ec5d835d1

                            SHA1

                            40050f785cad48a16e83bd17fea5746ada3c8fbe

                            SHA256

                            1ff33b9cbf02147c775f182a977d02649261b15c3db43ad065300432a002b588

                            SHA512

                            9ca6ae9ae6b05351b75827de78932d0783de5513aeca2b80d00ef7d90a2b0ea5bc53e22d74d85b00988d2df7a36a8809496066526b538c3fbc1733dd0efd94fa

                            Download Submit

                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
                            Filesize

                            2.2MB

                            MD5

                            cb1454f62ee002caa87fbb9f82e26cc9

                            SHA1

                            84f686f88ca0b50b45e70afe9c6988eb9de06c68

                            SHA256

                            44a1c6b3d3e4f4000ad686f0ef2209799cb092b9807539c43dded215260aaec5

                            SHA512

                            c5bb99ba69e38e9db378ff80a00953b6195f7839989f984a2cdbc5e7bc528e84a889519b2941e242a4a38d275d768f8ca62203b9e3d1e901f4bdff025d8952db

                            Download Submit

                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            Filesize

                            2.1MB

                            MD5

                            d7f36ec6690ae229b1fb19643e99b439

                            SHA1

                            044114f63151fa19167869d5e9009fc8ea81c49a

                            SHA256

                            d9bb0711e4fa8f07046f69a6e9b28442cbaddc9065df70f57b8cb0d64a71b28b

                            SHA512

                            a0bc10ab7fe8d5f34d756b156e4d13057bd06222d0783fedf7cfb405f372a6f4aafaef624da5b18ddc9b29862499b8202cd80fa61cad25c9a03b9f4c5be2f781

                            Download Submit

                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
                            Filesize

                            1.8MB

                            MD5

                            ee10f436c77d9dd2753d1fbeaeeba850

                            SHA1

                            2db31a5de740a165f90b9fc2e76a6389259f8d68

                            SHA256

                            5676e517edc0d96695262de045ae32d195533f0d2953677a13e27557915f60c6

                            SHA512

                            eed6117ad66fe812ce4f360b61f482bf1e9d21ef455d2e89e996ec168f18d7e53f1729ecd926324ba98a8c83de09b46fbc55df9ecde546a8f3b763fbfca88b9b

                            Download Submit

                          • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                            Filesize

                            1.5MB

                            MD5

                            217796036a190c7b1224dc8ebc1380a4

                            SHA1

                            22aa82303e3ddcb5d6c46c40894520fdf00abf0f

                            SHA256

                            140bb3b28e5e121fe1e0707c0d50890d70f1fe610a65123985d0d98ef247a8f4

                            SHA512

                            5c2884bb950061a0107a81fa5f92a8836814517348ca888e8e22c73d3e728ba382da3473d08fbb70e6fe798c9461e16f314000c298eb19a7d0d985449f9c863d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                            Filesize

                            24B

                            MD5

                            b9bd716de6739e51c620f2086f9c31e4

                            SHA1

                            9733d94607a3cba277e567af584510edd9febf62

                            SHA256

                            7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                            SHA512

                            cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                            Download Submit

                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                            Filesize

                            872KB

                            MD5

                            5c9ce5cdbd5a7381fe576e070d76b302

                            SHA1

                            18453c495859f67ca88eaae97cc1efdcfff6609d

                            SHA256

                            141956d2dacf5481116ab4ed65f740887f60e43f04615eec7fffaf0284ac5810

                            SHA512

                            ff4b7ade7b8ab51e78d308659e6aeb39d436bfbc61856e4aae8ef1b554740daf14dcea0464480198c20ebe0d6fb56a73b7ee4a01e1d4d4ab07deeb7effad8876

                            Download Submit

                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            Filesize

                            1.3MB

                            MD5

                            cb4e9a0d56fa7ec084d6a3653176ddff

                            SHA1

                            20f157b8b44e2f6685340931e013a0309397be42

                            SHA256

                            a5e15d8048620e875060ad4c530753d9b5ab5110d86818a0db28ff940d7a6bf2

                            SHA512

                            e7f9f1e41d02528ffc956893b55eb9da8b9917b484b0d2a77aa75b662d95a52c33bd14490eba4bd26e75c592f0d3bd0df656bbe3d2589677790d663862f237a2

                            Download Submit

                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                            Filesize

                            1.2MB

                            MD5

                            5f5237d2ffa08a876d20153285c4da96

                            SHA1

                            3c9ac2d85364bda21343141b6c7d44e760f5b7b4

                            SHA256

                            f501f7f1d4cf4ca1964dadc93debe15b3ebc029e589485e4d5de95e99f47dd7a

                            SHA512

                            93320f45f72766bd9a0668dc55d4e79b974b51b6d278d42b463924a14bc790b3a122c19cba32ded7232e0d933dee67ce1bb09100e8038b593834c8d333fb7045

                            Download Submit

                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                            Filesize

                            1003KB

                            MD5

                            ecf1a41c36ee5993be77aa710682111e

                            SHA1

                            8e11ceffc653da4e015cc599096380411e33cbb3

                            SHA256

                            5f2db9a5fadfeb0c73dbb7409e26061d6065facbe4705eaaabf59b6ab555ff2f

                            SHA512

                            4741c9d590461177577d1c3261493607ec61335b1ab38647f5d3d4d711db99e8bac7fbdae3d1cca5a52d1fda51b3cd77e070bf54e55a643298a9b5365c34df26

                            Download Submit

                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            Filesize

                            1.3MB

                            MD5

                            860332054c779d777fc9ea626dd73b04

                            SHA1

                            99ebfa30f1ee6cba23b9120e207496fe1e7834ec

                            SHA256

                            82c99d5f4d9d7f1e49d2025ae9c3fae98edc97c6a1e3a43aafe0a92f3dbd4316

                            SHA512

                            7cf2f2c42f9d615677552cfc8c96a5ba9bd069659d2aec1bcf93c02c481a732e3ffcd937b0e3614ac93dc73962f34c044c9cb4340d579183413b9f5780f03194

                            Download Submit

                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                            Filesize

                            8KB

                            MD5

                            77cccea5bc776e74255fc80ff100255a

                            SHA1

                            c7194549633314b9b02e01db512e86f52f88f9b2

                            SHA256

                            22afc803c37a064ee569792c13d83ba33b427ce388e657e14aa853bf14c71c98

                            SHA512

                            b03cf5c573332acf01220253f62604f51a475562d8b188dd105091a994236c43e18ab00efa93cd03ee3cadc271c0d0385b00cf863ac3694ccf11da384cb41ff9

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                            Filesize

                            148KB

                            MD5

                            ac901cf97363425059a50d1398e3454b

                            SHA1

                            2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

                            SHA256

                            f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

                            SHA512

                            6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                            Filesize

                            34KB

                            MD5

                            c26b034a8d6ab845b41ed6e8a8d6001d

                            SHA1

                            3a55774cf22d3244d30f9eb5e26c0a6792a3e493

                            SHA256

                            620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

                            SHA512

                            483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                            Filesize

                            109KB

                            MD5

                            0fd0f978e977a4122b64ae8f8541de54

                            SHA1

                            153d3390416fdeba1b150816cbbf968e355dc64f

                            SHA256

                            211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60

                            SHA512

                            ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\1f5d757f0db1005daa2dee10d6117655\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                            Filesize

                            143KB

                            MD5

                            0357fac505a1028f1b803e4170de3a62

                            SHA1

                            0ce8e6445a23e02b8b23e964e3cced0f304f556d

                            SHA256

                            c0d079e51a8b642b9e7fea65b241204f4d890ec4f81030b6e1cfc86ac8a2c435

                            SHA512

                            ebde8c35ffeb88ffdcf14b0e7ef669acd641822e9b3a919aeb8a29b01237a8b3b44e3a446d4a6b2fb53781e944dee94ae471b94ee12e27a279169d51a87acb12

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\238f5d3b72a04a882c9d078d05672d68\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                            Filesize

                            187KB

                            MD5

                            1f056748e97f890578b638583d9a17d1

                            SHA1

                            b84b48db9d4599c78b19dbb89a3f21c3ba56014e

                            SHA256

                            979662f08abf873bd85bf39b5912a77caf50cc7b691d3a5ebce8153d22a4bac2

                            SHA512

                            80385926ba80c27e09eeaac5e3c3dbc1e2d3304068fdc2e05abe3be3d7b534a99e7c4077037485a35d5fcf4a55124d4c8895ba677a3ffc78ab4b87ac69f007ef

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                            Filesize

                            41KB

                            MD5

                            3c269caf88ccaf71660d8dc6c56f4873

                            SHA1

                            f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

                            SHA256

                            de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

                            SHA512

                            bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                            Filesize

                            210KB

                            MD5

                            4f40997b51420653706cb0958086cd2d

                            SHA1

                            0069b956d17ce7d782a0e054995317f2f621b502

                            SHA256

                            8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

                            SHA512

                            e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                            Filesize

                            53KB

                            MD5

                            e3a7a2b65afd8ab8b154fdc7897595c3

                            SHA1

                            b21eefd6e23231470b5cf0bd0d7363879a2ed228

                            SHA256

                            e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

                            SHA512

                            6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9631826c76338d9242bd831373dc992d\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                            Filesize

                            83KB

                            MD5

                            8b718264d3d13d20bdeb66428858badf

                            SHA1

                            4a3240a9dcf44e23c0644a583896b1921e243d9b

                            SHA256

                            e1916ff1a92065e46c9a0c73837f7053a37c6066d8d381bf2f0722a29fe3b23b

                            SHA512

                            293e7cb8a48bc3b5b7fba88c714690eef4ee02a6e52006bb03cc63ce6e38d18909659192e9d77174c728d76cd7a0a9c8a1a5bc106eb287219a4faed4462ef8d0

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                            Filesize

                            28KB

                            MD5

                            aefc3f3c8e7499bad4d05284e8abd16c

                            SHA1

                            7ab718bde7fdb2d878d8725dc843cfeba44a71f7

                            SHA256

                            4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

                            SHA512

                            1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\d36d5faf337c14ca97417ad2d1b160d9\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                            Filesize

                            180KB

                            MD5

                            93d0775e417ce3677d7f01cee57f5140

                            SHA1

                            6c178349e4b6d3026732ed5186a1fe0860bc1e9b

                            SHA256

                            aca40c4be1ac4db099f03389d34da9764f226ecbfab53dbf15ca43f04ad93bc5

                            SHA512

                            267e573ebb93e1e2f0dae8777525e2975a259cc3f013e3e3815ebeaf688354401fbdc03775b12c0a7348595aa60d3ec3b9147079ebd6f383b832f2f66857e266

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                            Filesize

                            27KB

                            MD5

                            9c60454398ce4bce7a52cbda4a45d364

                            SHA1

                            da1e5de264a6f6051b332f8f32fa876d297bf620

                            SHA256

                            edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

                            SHA512

                            533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                            Filesize

                            57KB

                            MD5

                            6eaaa1f987d6e1d81badf8665c55a341

                            SHA1

                            e52db4ad92903ca03a5a54fdb66e2e6fad59efd5

                            SHA256

                            4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e

                            SHA512

                            dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                            Filesize

                            130KB

                            MD5

                            2735d2ab103beb0f7c1fbd6971838274

                            SHA1

                            6063646bc072546798bf8bf347425834f2bfad71

                            SHA256

                            f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

                            SHA512

                            fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                            Filesize

                            59KB

                            MD5

                            8c69bbdfbc8cc3fa3fa5edcd79901e94

                            SHA1

                            b8028f0f557692221d5c0160ec6ce414b2bdf19b

                            SHA256

                            a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

                            SHA512

                            825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                            Filesize

                            42KB

                            MD5

                            71d4273e5b77cf01239a5d4f29e064fc

                            SHA1

                            e8876dea4e4c4c099e27234742016be3c80d8b62

                            SHA256

                            f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

                            SHA512

                            41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
                            Filesize

                            855KB

                            MD5

                            7812b0a90d92b4812d4063b89a970c58

                            SHA1

                            3c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea

                            SHA256

                            897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543

                            SHA512

                            634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed

                            Download Submit

                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
                            Filesize

                            43KB

                            MD5

                            3e72bdd0663c5b2bcd530f74139c83e3

                            SHA1

                            66069bcac0207512b9e07320f4fa5934650677d2

                            SHA256

                            6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

                            SHA512

                            b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

                            Download Submit

                          • C:\Windows\system32\IEEtwCollector.exe
                            Filesize

                            1.3MB

                            MD5

                            1a0071a6200350ca0ca3472b2107a649

                            SHA1

                            fca628a6fef7c0f2e88c13003bdcb5b126da8070

                            SHA256

                            131c1880373591cb95551cd5ef91f781b469fc729da0a75bf44f6cf13d8ecc1f

                            SHA512

                            9ff8f125534fc778184f833e3c6f9f4c5905eb646d887c840cdf238b7ab297173ea8a08a867ca74fb994f991c038c94e75ef8654bd1aa14683e17a1c2a8ea932

                            Download Submit

                          • C:\Windows\system32\fxssvc.exe
                            Filesize

                            1.2MB

                            MD5

                            2ecb8ad74ce55b06e4c63fb593aec331

                            SHA1

                            87a9d7f310dac13b821c81472c3fdbeb44c7f185

                            SHA256

                            868cb26e5a53fef99d0bb61244cae8f136da7318ba507de0751c8bd258a6ec3f

                            SHA512

                            c69308a5d63042cc5b1448c0df4b603bc7c8cf38d8737c5b2f96988f3a6f2d9d7ae46354bb925f3dde91f7866c4254b516a341bf4c26070bb9cc18c863bf4b13

                            Download Submit

                          • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                            Filesize

                            1.3MB

                            MD5

                            a50a4a2a81503bc5395e8f5fef9bcaa2

                            SHA1

                            0115d430a00ca432e47c7f20ccb4c5aa69cabfd8

                            SHA256

                            0354a77adba916abdaae5f5c735ba44b6fcfe9e5e9399f9621c34e13efaed63d

                            SHA512

                            f327df45ca496525ecc0a7b0f25b329c0528765f26211d9f35e043db0060c602fa706c9b2dae3e9c5eeb2e87b0e891ebf95a32baa62ffa29813bf8614409cc90

                            Download Submit

                          • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                            Filesize

                            1.2MB

                            MD5

                            3eadd9951e8bd1ca54bb711a29e804c7

                            SHA1

                            51fd7435c924d3a4b9fb296bfef5b13bf2afe863

                            SHA256

                            b38abeb1abec81865ae50ffec76642ad9e1cb185abdb61e42a20a53d9607c96d

                            SHA512

                            0486867799355eda3021e26c84f8ede8ad6fc18c8c2b9861e9fab6fe8534b0f77fbb84229da4f7eb841f77e0743285096f69743172ace311fad8355bf8b281dd

                            Download Submit

                          • \Windows\System32\alg.exe
                            Filesize

                            1.3MB

                            MD5

                            8e56a9fab02ad5423728f55508c99d9b

                            SHA1

                            322c0f0c90eebb8d7b11dd391819313e033ec352

                            SHA256

                            48d81f513bec8674255a5252ef0c9250f1a0b58dfd44d84b26bb4ac0db2551c6

                            SHA512

                            46501fa97ea0e8d5f4c959557b05cf2dfbef5c4755ce98fcda553f56d1f29703d23f3f0315e0ac8935ea6c5dab71d459ce47c01abc8a9376781252b8016bc729

                            Download Submit

                          • \Windows\ehome\ehrecvr.exe
                            Filesize

                            1.2MB

                            MD5

                            6a76971feb61027ca1683dc5fdecfeff

                            SHA1

                            374c1c52a8570066c553830f7dcbd8849a01d602

                            SHA256

                            b699fe5f6e1c67b7a214dd616a62eb2a63d3b6625422b7ba4f5ce85780ba7317

                            SHA512

                            a1ba25d3d9298d44fb36e133d0b206c483a077e530cf76409254166ba70c59240c75bd60d8cd3cc1b643de9637a50394e78e34cbbf7777beafe06d95fa1c0a59

                            Download Submit

                          • \Windows\ehome\ehsched.exe
                            Filesize

                            1.3MB

                            MD5

                            d2c638bd30b1ad28f9b76804cdbd97a0

                            SHA1

                            2eb2cb4bba8446add365ed3b2ca081da57598fd3

                            SHA256

                            a7a847edbe9059525613b7b2c6735b319528831f04d447f6f57739b5417975a7

                            SHA512

                            8367fba658b2dcba02e7a92119207acb83b11f100ba133ac5da561a88ccf861c7c61962dc20045d47682906ddfc0bb89440769d2dc70055eef5dccf04de913c2

                            Download Submit

                          • memory/272-52-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/272-674-0x0000000001D50000-0x0000000001D5A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/272-675-0x0000000001D50000-0x0000000001D6E000-memory.dmp

                            Filesize

                            120KB

                            Download

                          • memory/272-676-0x0000000001D50000-0x0000000001D6A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/272-677-0x0000000001D50000-0x0000000001DDC000-memory.dmp

                            Filesize

                            560KB

                            Download

                          • memory/272-678-0x0000000001D50000-0x0000000001DF4000-memory.dmp

                            Filesize

                            656KB

                            Download

                          • memory/272-178-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/272-679-0x0000000001FE0000-0x000000000217E000-memory.dmp

                            Filesize

                            1.6MB

                            Download

                          • memory/272-680-0x0000000001D50000-0x0000000001E3C000-memory.dmp

                            Filesize

                            944KB

                            Download

                          • memory/272-681-0x0000000001D50000-0x0000000001D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/272-682-0x0000000001D50000-0x0000000001DD8000-memory.dmp

                            Filesize

                            544KB

                            Download

                          • memory/272-683-0x0000000001D50000-0x0000000001D74000-memory.dmp

                            Filesize

                            144KB

                            Download

                          • memory/272-684-0x0000000001D50000-0x0000000001D58000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/272-685-0x0000000001D50000-0x0000000001D7A000-memory.dmp

                            Filesize

                            168KB

                            Download

                          • memory/272-686-0x0000000001D50000-0x0000000001DB6000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/272-59-0x00000000002E0000-0x0000000000347000-memory.dmp

                            Filesize

                            412KB

                            Download

                          • memory/272-53-0x00000000002E0000-0x0000000000347000-memory.dmp

                            Filesize

                            412KB

                            Download

                          • memory/536-595-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/536-605-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/548-114-0x0000000000270000-0x00000000002D0000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/548-189-0x0000000140000000-0x00000001401F1000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/548-108-0x0000000000270000-0x00000000002D0000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/548-563-0x0000000140000000-0x00000001401F1000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/548-105-0x0000000140000000-0x00000001401F1000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/636-446-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/636-99-0x0000000010000000-0x00000000101E6000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/636-454-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/636-45-0x0000000010000000-0x00000000101E6000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/648-424-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/648-408-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/648-588-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/832-91-0x0000000000880000-0x00000000008E0000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/832-651-0x0000000140000000-0x000000014013C000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/832-90-0x0000000140000000-0x000000014013C000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/832-186-0x0000000140000000-0x000000014013C000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/832-107-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/832-106-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/832-97-0x0000000000880000-0x00000000008E0000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/844-132-0x00000000002D0000-0x0000000000330000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/844-1-0x00000000002D0000-0x0000000000330000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/844-9-0x00000000002D0000-0x0000000000330000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/844-7-0x00000000002D0000-0x0000000000330000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/844-131-0x0000000140000000-0x0000000140125000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/844-89-0x0000000140000000-0x0000000140125000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/844-0-0x0000000140000000-0x0000000140125000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/1120-600-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1120-587-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1248-292-0x000000002E000000-0x000000002E1F4000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1248-164-0x000000002E000000-0x000000002E1F4000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1332-380-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1496-146-0x000000002E000000-0x000000002FE1E000-memory.dmp

                            Filesize

                            30.1MB

                            Download

                          • memory/1496-242-0x000000002E000000-0x000000002FE1E000-memory.dmp

                            Filesize

                            30.1MB

                            Download

                          • memory/1512-514-0x0000000003D70000-0x0000000003E2A000-memory.dmp

                            Filesize

                            744KB

                            Download

                          • memory/1512-510-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1512-517-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1536-474-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1628-513-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1712-485-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1712-499-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1720-332-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1720-352-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1744-526-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1744-539-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1804-160-0x0000000140000000-0x0000000140209000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1804-156-0x0000000140000000-0x0000000140209000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1840-540-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/1840-544-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2132-294-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2132-320-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2168-397-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2168-409-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2312-193-0x0000000140000000-0x0000000140237000-memory.dmp

                            Filesize

                            2.2MB

                            Download

                          • memory/2312-125-0x0000000140000000-0x0000000140237000-memory.dmp

                            Filesize

                            2.2MB

                            Download

                          • memory/2312-119-0x0000000000910000-0x0000000000970000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/2384-637-0x0000000140000000-0x00000001401ED000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2384-645-0x0000000140000000-0x00000001401ED000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2500-615-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2560-299-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2560-266-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2568-642-0x0000000140000000-0x00000001401ED000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2568-625-0x0000000140000000-0x00000001401ED000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2592-33-0x00000000002B0000-0x0000000000317000-memory.dmp

                            Filesize

                            412KB

                            Download

                          • memory/2592-31-0x0000000010000000-0x00000000101DE000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2592-37-0x00000000002B0000-0x0000000000317000-memory.dmp

                            Filesize

                            412KB

                            Download

                          • memory/2592-80-0x0000000010000000-0x00000000101DE000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2616-313-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2616-331-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2660-69-0x0000000000AA0000-0x0000000000B00000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/2660-184-0x0000000140000000-0x00000001401ED000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2660-75-0x0000000140000000-0x00000001401ED000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2660-76-0x0000000000AA0000-0x0000000000B00000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/2668-1356-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2668-646-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2800-14-0x0000000000900000-0x0000000000960000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/2800-22-0x0000000100000000-0x00000001001E3000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2800-23-0x0000000000900000-0x0000000000960000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/2800-104-0x0000000100000000-0x00000001001E3000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2856-137-0x0000000140000000-0x00000001401DC000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2856-28-0x0000000140000000-0x00000001401DC000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2860-389-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2860-378-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2864-278-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2864-245-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2864-449-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2960-555-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/2960-576-0x0000000000400000-0x00000000005E7000-memory.dmp

                            Filesize

                            1.9MB

                            Download