Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 07:02

General

  • Target

    JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe

  • Size

    645KB

  • MD5

    09d607bb679423c3a1636d922b0470a8

  • SHA1

    29895b10fbb22ea67adc7c05f9bde69dc79d8f68

  • SHA256

    52c44545129a7efe21cc8a3b71a4166af528a5b5142425617dcc907f62471478

  • SHA512

    90413037654dec1ecdd469cdc8a863ae82ac586a30f9e683aa1b9e3f8a54bc494fb99860f4fd4af4e5bc1da6974501af5a3c91e063fb762528f2f559a23ce0b6

  • SSDEEP

    12288:rYG8GLVeUF+bZnoD2kUQf3zyJQ/aEy+W27jIhyeNnCZ:0G8GLwA+bZWXUQfDyqCINghygnCZ

Malware Config

Signatures

  • Expiro family
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

  • Expiro payload 3 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09d607bb679423c3a1636d922b0470a8.exe"
    1⤵
    • Drops Chrome extension
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2444
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2644
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2756
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2980
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Windows security modification
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1604
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 238 -NGENProcess 244 -Pipe 22c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2032
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 1e4 -NGENProcess 150 -Pipe 184 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1728
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 268 -NGENProcess 1e8 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1612
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2096
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 150 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 1e8 -Pipe 15c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2404
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 150 -NGENProcess 1e8 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1928
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 150 -InterruptEvent 250 -NGENProcess 278 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2000
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 278 -NGENProcess 274 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1968
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 288 -NGENProcess f4 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1740
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent f4 -NGENProcess 250 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2300
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent f4 -InterruptEvent 290 -NGENProcess 274 -Pipe 150 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2284
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 288 -NGENProcess 274 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2112
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 298 -NGENProcess 250 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2264
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 290 -NGENProcess 2a0 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2800
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 258 -NGENProcess 250 -Pipe f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2664
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 250 -NGENProcess 29c -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:388
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 25c -NGENProcess 274 -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1892
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 274 -NGENProcess 258 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2288
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2b0 -NGENProcess 29c -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:628
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 29c -NGENProcess 25c -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2192
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2b8 -NGENProcess 258 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2072
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 258 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2136
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2c0 -NGENProcess 25c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1632
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 25c -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2008
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2448
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1968
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2064
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2200
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2a4 -NGENProcess 2b8 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1884
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2b8 -NGENProcess 2d4 -Pipe 2d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1736
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2e0 -NGENProcess 2d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2596
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2d8 -NGENProcess 2a4 -Pipe 2dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3008
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2e8 -NGENProcess 2d4 -Pipe 2c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:788
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d4 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2884
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f0 -NGENProcess 2a4 -Pipe 2b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2288
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2a4 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:1316
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:900
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 304 -NGENProcess 2c0 -Pipe 300 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1912
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2d4 -Pipe 2a8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1428
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:320
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2c0 -Pipe 2a4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1740
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2c0 -NGENProcess 308 -Pipe 2d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2524
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 308 -NGENProcess 2f4 -Pipe 2d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2760
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 31c -NGENProcess 314 -Pipe 304 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2824
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 314 -NGENProcess 2c0 -Pipe 318 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1844
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 324 -NGENProcess 2f4 -Pipe 310 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2944
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 320 -Pipe 2f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3004
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2c0 -Pipe 308 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1556
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2f4 -Pipe 30c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2596
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 320 -Pipe 31c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1192
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2c0 -Pipe 314 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2296
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2f4 -Pipe 324 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1852
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 320 -Pipe 328 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1684
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2c0 -Pipe 32c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1728
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2f4 -Pipe 330 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2916
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 320 -Pipe 334 -Comment "NGen Worker Process"
      2⤵
        PID:1488
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2c0 -Pipe 338 -Comment "NGen Worker Process"
        2⤵
          PID:1300
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2f4 -Pipe 33c -Comment "NGen Worker Process"
          2⤵
            PID:708
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 320 -Pipe 340 -Comment "NGen Worker Process"
            2⤵
              PID:1956
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2c0 -Pipe 344 -Comment "NGen Worker Process"
              2⤵
                PID:1604
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 2f4 -Pipe 348 -Comment "NGen Worker Process"
                2⤵
                  PID:684
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 320 -Pipe 34c -Comment "NGen Worker Process"
                  2⤵
                  • Modifies data under HKEY_USERS
                  PID:1700
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 2c0 -Pipe 350 -Comment "NGen Worker Process"
                  2⤵
                    PID:2008
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 2f4 -Pipe 354 -Comment "NGen Worker Process"
                    2⤵
                      PID:1316
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 320 -Pipe 358 -Comment "NGen Worker Process"
                      2⤵
                        PID:2380
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 2c0 -Pipe 35c -Comment "NGen Worker Process"
                        2⤵
                          PID:1660
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 36c -NGENProcess 378 -Pipe 370 -Comment "NGen Worker Process"
                          2⤵
                            PID:2812
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 364 -NGENProcess 2c0 -Pipe 2fc -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:1012
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 2c0 -NGENProcess 360 -Pipe 374 -Comment "NGen Worker Process"
                            2⤵
                              PID:1364
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 380 -NGENProcess 378 -Pipe 2f8 -Comment "NGen Worker Process"
                              2⤵
                                PID:548
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 37c -Pipe 2f4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:1964
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 360 -Pipe 36c -Comment "NGen Worker Process"
                                  2⤵
                                    PID:3000
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 378 -Pipe 320 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2740
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 37c -Pipe 364 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:2152
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 360 -Pipe 2c0 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:2880
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 378 -Pipe 380 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2600
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 37c -Pipe 384 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2944
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 360 -Pipe 388 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:2560
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 378 -Pipe 38c -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2604
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 37c -Pipe 390 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1984
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 360 -Pipe 394 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1652
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 378 -Pipe 398 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:1452
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 37c -Pipe 39c -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2924
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 360 -Pipe 3a0 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1440
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 378 -Pipe 3a4 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1588
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 37c -Pipe 3a8 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:276
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 360 -Pipe 3ac -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:1224
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 378 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:840
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 37c -Pipe 3b4 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2648
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 360 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1788
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 378 -Pipe 3bc -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2996
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 37c -Pipe 3c0 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1632
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 360 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:1296
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 378 -Pipe 3c8 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1704
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 37c -Pipe 3cc -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2780
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 360 -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1600
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 378 -Pipe 3d4 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:892
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 37c -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2224
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 360 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:1640
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3ec -NGENProcess 3f8 -Pipe 3f0 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2356
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 378 -NGENProcess 3e4 -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:1372
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 3e4 -NGENProcess 360 -Pipe 3f8 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2488
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3fc -NGENProcess 3ec -Pipe 3f4 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2560
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3ec -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1652
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 408 -NGENProcess 360 -Pipe 368 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        PID:1208
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 360 -NGENProcess 3fc -Pipe 404 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                        • Modifies data under HKEY_USERS
                                                                                        PID:2360
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 3e8 -NGENProcess 194 -Pipe 378 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        PID:276
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 194 -NGENProcess 408 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:1260
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 410 -NGENProcess 3fc -Pipe 3ec -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:1788
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 40c -Pipe 2cc -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:1416
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 408 -Pipe 360 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:1840
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3fc -Pipe 198 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1676
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 40c -Pipe 3e8 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:1704
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 408 -Pipe 194 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:2780
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 3fc -Pipe 410 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1600
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 40c -Pipe 414 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2708
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 424 -NGENProcess 430 -Pipe 428 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2412
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 26c -NGENProcess 40c -Pipe 41c -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:3040
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 434 -NGENProcess 42c -Pipe 3fc -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2300
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 430 -Pipe 134 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2312
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 40c -Pipe 408 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2364
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 42c -Pipe 418 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:944
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 430 -Pipe 424 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2524
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 40c -Pipe 26c -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2904
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 42c -Pipe 434 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2544
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 450 -NGENProcess 430 -Pipe 438 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:804
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 454 -NGENProcess 40c -Pipe 43c -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:3004
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 448 -NGENProcess 430 -Pipe 454 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:596
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 464 -NGENProcess 420 -Pipe 460 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:1192
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 420 -NGENProcess 44c -Pipe 40c -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:788
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 46c -NGENProcess 430 -Pipe 440 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2900
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 468 -Pipe 458 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2884
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 474 -NGENProcess 44c -Pipe 448 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1008
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 478 -NGENProcess 430 -Pipe 444 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2472
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 47c -NGENProcess 468 -Pipe 464 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2976
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 468 -NGENProcess 474 -Pipe 44c -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2248
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 484 -NGENProcess 430 -Pipe 46c -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2304
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 430 -NGENProcess 47c -Pipe 480 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:684
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 48c -NGENProcess 474 -Pipe 478 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:1700
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 474 -NGENProcess 484 -Pipe 488 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:1860
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1460
                                                                                                                                            • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                              C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1448

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

                                                                                                                                              Filesize

                                                                                                                                              640KB

                                                                                                                                              MD5

                                                                                                                                              7f73299cbe72cddf4eaf4fba8e2bfdf5

                                                                                                                                              SHA1

                                                                                                                                              32ad786a1f4cc5ce7a395cb8d35e2df4141e702c

                                                                                                                                              SHA256

                                                                                                                                              93a566ee68b6bbac614ba060d9e0637d76243f486b3ea3b86bd7e54d8efc74e1

                                                                                                                                              SHA512

                                                                                                                                              df88e8ba3885231eefa7d15e4ee3a3e6df6e394e5156741d9e79d2ce12c0b9ac105995fa76b9aace75346f12f05965877a9693e0f0bd1a315b32ef4923645a77

                                                                                                                                            • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

                                                                                                                                              Filesize

                                                                                                                                              1.5MB

                                                                                                                                              MD5

                                                                                                                                              a68e864960148e5bc0dae2c7bd7210f5

                                                                                                                                              SHA1

                                                                                                                                              3c379f211f0eeb01a666416157e6a24cff717d8f

                                                                                                                                              SHA256

                                                                                                                                              67facb2a3baac0a04a470c994cd8af7492c2fc314a7cd70549469acb87622a82

                                                                                                                                              SHA512

                                                                                                                                              d445165821f636b296f3bf8bcca9e13e808558747d538d332694d74a08c53fe2ade84e221ab83561de6bccab91faef1a6f5a7ca1ae3ec4df7266946429b3b78e

                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

                                                                                                                                              Filesize

                                                                                                                                              4.8MB

                                                                                                                                              MD5

                                                                                                                                              585ef957502c9f485704f5c7759e29bf

                                                                                                                                              SHA1

                                                                                                                                              d1c0e0bc6f8b33724b1a893a51c358db8769b0fb

                                                                                                                                              SHA256

                                                                                                                                              cd34e4b0ad5371d6d3e762b7f9cbf3117a48e1a6dc21914247c10af97f2f08c0

                                                                                                                                              SHA512

                                                                                                                                              b678418530765b088c6663926653675367655aeee2797e6598a07cf871e3d0b8dc26c28b85d58b7e5ef99d7e1b16b4edae0f6d61cb63649c36759423b82665d0

                                                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              MD5

                                                                                                                                              a8da7f72cbf9360c9cb6e152e14ab6b8

                                                                                                                                              SHA1

                                                                                                                                              6475017ab836ee685102151234d4b3a3b1badc81

                                                                                                                                              SHA256

                                                                                                                                              3be6958e7e5cbca06a37c4fbaded081e3fc5a7959d25f8b8a3261fa81698b985

                                                                                                                                              SHA512

                                                                                                                                              c1b7199d9f39e8772f21a19920eddb6e51868205af2d1e9ffc04ac196b8b5f9a3e76701981c7f1438926c296226fac7fe36a1ebba3bf7de077b291e4c8e3c68c

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                                                                                                              Filesize

                                                                                                                                              872KB

                                                                                                                                              MD5

                                                                                                                                              0914363d599ee5c78c2ed9e1fea646c7

                                                                                                                                              SHA1

                                                                                                                                              aa3cec30994ba5a53efed2874c099dc629bd978f

                                                                                                                                              SHA256

                                                                                                                                              0e34e919b59717759ed1c7cca2338f56b39839f60f66972b380d96785d891963

                                                                                                                                              SHA512

                                                                                                                                              078c9bfe0dcc988e9cf83f02b5c54355d32d609ce868c6b661019b1163fd4bd33be2d35ecc7829ada59bfe6e0aa8f47271e1d84efa4461e3840da943a0545be5

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              MD5

                                                                                                                                              069afe5dfe6216850bdd838e1ac68ad6

                                                                                                                                              SHA1

                                                                                                                                              90d656d48fb9b3aeca7197d5213ea0fa6250d1f9

                                                                                                                                              SHA256

                                                                                                                                              de3e45f5e1c066da12af07972c261e7ced7e3f2115f76aba9f2a56fad167d18c

                                                                                                                                              SHA512

                                                                                                                                              8a4257fd0417b22902d1f4441548d76c21053bc82e083e583a63fffe06d0cd4269d42d8bc000f78bf1c79e24c77887183fd8c4bc45c397e000fa346a71e5d84b

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                                                                                                              Filesize

                                                                                                                                              559KB

                                                                                                                                              MD5

                                                                                                                                              c022fa6bef158cef223861f573bce1f3

                                                                                                                                              SHA1

                                                                                                                                              ac92c624edea0dc98c23b3713f3884039dfa7f14

                                                                                                                                              SHA256

                                                                                                                                              28123111de2b4abdfdaddbc93bd90e4931f02df5ee7ec5fbed9b77c1fb93724d

                                                                                                                                              SHA512

                                                                                                                                              ca291a9c61bda8b0b8cd7ff86c0dac8c22859bf9c62ea7cb1023489029d3db1d7244546a9dfe0f17903e06ba71bee9cff42fa4b809a56bb69c71ebf1a6c7baaa

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                                                                                                              Filesize

                                                                                                                                              1003KB

                                                                                                                                              MD5

                                                                                                                                              7fe85265e91bad445609093b0a508761

                                                                                                                                              SHA1

                                                                                                                                              bc9a84cf92b379647490282a75af0577f9492460

                                                                                                                                              SHA256

                                                                                                                                              74205751d8dffec2c86d712367f272c9a7bc2d0aa15c4889eec58894c21dae2e

                                                                                                                                              SHA512

                                                                                                                                              2c03287944b07d4584d4a81747d2c88445bec052177abef9263920eebf43cbf8264bad82c077cb83ee6491f71ed1b80a411efaccbeb9222a75e1a35532934e22

                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                                                                                                              Filesize

                                                                                                                                              590KB

                                                                                                                                              MD5

                                                                                                                                              2e245009192ff4054f234e23ab5e0b8c

                                                                                                                                              SHA1

                                                                                                                                              2d70b06eb51aaf3f029f23429726cbcc16417611

                                                                                                                                              SHA256

                                                                                                                                              e9a16830704fba79218882dafbaea8a8bf8f6886d0118e04954eb5b29e7074d7

                                                                                                                                              SHA512

                                                                                                                                              ab26be2be2b74e6d2a01b4ad70a7d6f2c3d04405849c40bf465ec68f52c83948e31efdcccd6e01827aa584784f9d193df510bc6e9c8bf631a0155825076613e4

                                                                                                                                            • C:\Windows\Temp\CabE540.tmp

                                                                                                                                              Filesize

                                                                                                                                              29KB

                                                                                                                                              MD5

                                                                                                                                              d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                              SHA1

                                                                                                                                              e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                              SHA256

                                                                                                                                              a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                              SHA512

                                                                                                                                              17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                            • C:\Windows\Temp\TarE66B.tmp

                                                                                                                                              Filesize

                                                                                                                                              81KB

                                                                                                                                              MD5

                                                                                                                                              b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                              SHA1

                                                                                                                                              7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                              SHA256

                                                                                                                                              725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                              SHA512

                                                                                                                                              f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              105KB

                                                                                                                                              MD5

                                                                                                                                              d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                              SHA1

                                                                                                                                              9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                              SHA256

                                                                                                                                              dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                              SHA512

                                                                                                                                              5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              MD5

                                                                                                                                              7835e60e560a49049ae728698da3d301

                                                                                                                                              SHA1

                                                                                                                                              87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

                                                                                                                                              SHA256

                                                                                                                                              df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

                                                                                                                                              SHA512

                                                                                                                                              b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              238KB

                                                                                                                                              MD5

                                                                                                                                              0a4ed78b7995d94fa42379f84cd5f8e9

                                                                                                                                              SHA1

                                                                                                                                              90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

                                                                                                                                              SHA256

                                                                                                                                              0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

                                                                                                                                              SHA512

                                                                                                                                              86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              9958f23efa2a86f8195f11054f94189a

                                                                                                                                              SHA1

                                                                                                                                              78ec93b44569ea7ebce452765568da5c73511931

                                                                                                                                              SHA256

                                                                                                                                              3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

                                                                                                                                              SHA512

                                                                                                                                              3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              1.0MB

                                                                                                                                              MD5

                                                                                                                                              598a06ea8f1611a24f86bc0bef0f547e

                                                                                                                                              SHA1

                                                                                                                                              5a4401a54aa6cd5d8fd883702467879fb5823e37

                                                                                                                                              SHA256

                                                                                                                                              e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

                                                                                                                                              SHA512

                                                                                                                                              774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              205KB

                                                                                                                                              MD5

                                                                                                                                              0a41e63195a60814fe770be368b4992f

                                                                                                                                              SHA1

                                                                                                                                              d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                              SHA256

                                                                                                                                              4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                              SHA512

                                                                                                                                              1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\1d04b18f7609f45b92967e02ea7234f8\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              271KB

                                                                                                                                              MD5

                                                                                                                                              0b8b80dfdb6f91591166ee504aa01b75

                                                                                                                                              SHA1

                                                                                                                                              ddf87b403fbbe68f56e76f0622331f643d6f3ae8

                                                                                                                                              SHA256

                                                                                                                                              247320a3bde2fe530abdd36954b53331e209b47edaa071c95af8f878217227ab

                                                                                                                                              SHA512

                                                                                                                                              2d34103cafbd29c5126cdcb847557bece3f027b0761d087a4d23554af9002bee65ef015441c30fc5bd8f2e8be1e1aa47e74557bc45f69fdcdd611562a327b0b6

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              43KB

                                                                                                                                              MD5

                                                                                                                                              68c51bcdc03e97a119431061273f045a

                                                                                                                                              SHA1

                                                                                                                                              6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                              SHA256

                                                                                                                                              4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                              SHA512

                                                                                                                                              d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              198KB

                                                                                                                                              MD5

                                                                                                                                              9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                              SHA1

                                                                                                                                              ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                              SHA256

                                                                                                                                              469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                              SHA512

                                                                                                                                              58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              91KB

                                                                                                                                              MD5

                                                                                                                                              adc5887e89bc56694a193d92898d3518

                                                                                                                                              SHA1

                                                                                                                                              267f14c45a86d50ad627c6cb00626049e9c1ee20

                                                                                                                                              SHA256

                                                                                                                                              edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b

                                                                                                                                              SHA512

                                                                                                                                              bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              04a6857c04546270358d14398fde209e

                                                                                                                                              SHA1

                                                                                                                                              596a3e11ac6c303c679edfd6c30aa71e8eaf8a23

                                                                                                                                              SHA256

                                                                                                                                              8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285

                                                                                                                                              SHA512

                                                                                                                                              4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              381KB

                                                                                                                                              MD5

                                                                                                                                              0811b25e0449e04f782127bc6f8ac5e3

                                                                                                                                              SHA1

                                                                                                                                              dc1766e20ee338b12fa80e3ce0052ef97ddf9e20

                                                                                                                                              SHA256

                                                                                                                                              20d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c

                                                                                                                                              SHA512

                                                                                                                                              a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6b2fd10bbaf4e1664b9d452e4af50041\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              221KB

                                                                                                                                              MD5

                                                                                                                                              9d384392f8f790ed0eeae3995a2598e2

                                                                                                                                              SHA1

                                                                                                                                              70745684ab02db32735fd49d9923ef3455665089

                                                                                                                                              SHA256

                                                                                                                                              624fe210593cfba4beea131b8cb6a0bbe4d963ea5d9950e9533aaad7b222b4d8

                                                                                                                                              SHA512

                                                                                                                                              6f44eebc95476733f660ee900f02f8e2d660d1cacaea678fba1444a8d78a1c8f8fb83387e7a3b41819a1c27a17db45798870094fc53fbced51cb81e9f102d10e

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              70KB

                                                                                                                                              MD5

                                                                                                                                              57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                              SHA1

                                                                                                                                              da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                              SHA256

                                                                                                                                              1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                              SHA512

                                                                                                                                              1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\85a37f210262e918838119e18175f7aa\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              122KB

                                                                                                                                              MD5

                                                                                                                                              e65471f236d29cb9f14b920887299362

                                                                                                                                              SHA1

                                                                                                                                              5ac5615d174669aab2026bd95fbef498698ae59f

                                                                                                                                              SHA256

                                                                                                                                              0cdef13e054c3754b4b61df29474ff0d0ba7cf81ca0bbaacca1a45af4c6bc3ba

                                                                                                                                              SHA512

                                                                                                                                              8e983a3207025e6f60c3863c0a0eaf68a0559250ba2f0c68a6c6992c0dc026a3a99f8e7156f9232ddcee72af68da8f9b7c71b7942debb103540bec59634e90de

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              82KB

                                                                                                                                              MD5

                                                                                                                                              2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                              SHA1

                                                                                                                                              66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                              SHA256

                                                                                                                                              37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                              SHA512

                                                                                                                                              cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              483KB

                                                                                                                                              MD5

                                                                                                                                              aae5a97685a809d0a0f661f9319f8a12

                                                                                                                                              SHA1

                                                                                                                                              b5fdd4ec4cc057fccc868de4f4910be89e23e48a

                                                                                                                                              SHA256

                                                                                                                                              c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233

                                                                                                                                              SHA512

                                                                                                                                              d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\eff1914071b00d996d03b0261aa31c00\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              305KB

                                                                                                                                              MD5

                                                                                                                                              668ca8482e32847e3f60b5690fde1f00

                                                                                                                                              SHA1

                                                                                                                                              78ece99048638940cd47756127cbd263d5e5715e

                                                                                                                                              SHA256

                                                                                                                                              703fb2f96abfd39e2e579e3c4ddcacdf95e0494b2a09b771ccaffa4bc06ce481

                                                                                                                                              SHA512

                                                                                                                                              16b67307e72f005b21d465233c02eaa04a53f36d3b0bf04994da51d833fee854a5efd3a4e31fee711a3125664e242735059b3cca6dbfa99ebf60206f27fd8076

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              43KB

                                                                                                                                              MD5

                                                                                                                                              dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                              SHA1

                                                                                                                                              d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                              SHA256

                                                                                                                                              f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                              SHA512

                                                                                                                                              8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              124KB

                                                                                                                                              MD5

                                                                                                                                              929653b5b019b4555b25d55e6bf9987b

                                                                                                                                              SHA1

                                                                                                                                              993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                              SHA256

                                                                                                                                              2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                              SHA512

                                                                                                                                              effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              MD5

                                                                                                                                              10b5a285eafccdd35390bb49861657e7

                                                                                                                                              SHA1

                                                                                                                                              62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                              SHA256

                                                                                                                                              5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                              SHA512

                                                                                                                                              19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                            • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

                                                                                                                                              Filesize

                                                                                                                                              88KB

                                                                                                                                              MD5

                                                                                                                                              1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                              SHA1

                                                                                                                                              4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                              SHA256

                                                                                                                                              9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                              SHA512

                                                                                                                                              e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                            • \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

                                                                                                                                              Filesize

                                                                                                                                              640KB

                                                                                                                                              MD5

                                                                                                                                              7f34ab31a916299e41297e55941bed00

                                                                                                                                              SHA1

                                                                                                                                              7379e33ff54b7bac7e125b67396f50468f4cdcea

                                                                                                                                              SHA256

                                                                                                                                              f171d625e10774ca91fc582c01b32310262ac0a63324fe4aaee73dc031e2de16

                                                                                                                                              SHA512

                                                                                                                                              2ba4f738234287293674a89193c13812d4edf301b4d1632ca39f324161399cdc47dc995b14c26ca10f6e2928cac563a571af549e89b83fde0f61917651af596c

                                                                                                                                            • \??\c:\program files (x86)\microsoft office\office14\groove.exe

                                                                                                                                              Filesize

                                                                                                                                              30.0MB

                                                                                                                                              MD5

                                                                                                                                              53a38d8a303dfb5a37d2c657da1011a5

                                                                                                                                              SHA1

                                                                                                                                              d66a56cf83b2a177b3568c6e0c9084b3913a9f12

                                                                                                                                              SHA256

                                                                                                                                              25b97af55e244a5a9bc69d5a1b6a4fb24985b59ede27aa50cdf241259c0a3804

                                                                                                                                              SHA512

                                                                                                                                              e3f8283d85d06dcf7bd69f2092234b068036b23269042585d750ee233d6e49047f08be64bd55868f7b974700b6ae607704bb39dd881784856c333c4654fd3034

                                                                                                                                            • \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

                                                                                                                                              Filesize

                                                                                                                                              715KB

                                                                                                                                              MD5

                                                                                                                                              92f779bb9a8dbc96070a164219216afe

                                                                                                                                              SHA1

                                                                                                                                              275c950948001a289b0fde27ddec3636a6000e81

                                                                                                                                              SHA256

                                                                                                                                              95c9250f772e8526b6db43530afe9619dec13d1d24c29127ea8485f6c5dc198e

                                                                                                                                              SHA512

                                                                                                                                              a547f65bc2eef2b50c2f5fff54575d68b3a76abb2a67fdda2b20ee6d15be1b216095fa8ba2076ff2568cb79992649fbb54d23a2f047d350e55dd9708b10f9da9

                                                                                                                                            • \??\c:\windows\ehome\ehsched.exe

                                                                                                                                              Filesize

                                                                                                                                              624KB

                                                                                                                                              MD5

                                                                                                                                              5d0ed0d00acbc8e873cb5cebef22550c

                                                                                                                                              SHA1

                                                                                                                                              ea184a1029a980600b14aa7e4326e9c4ed593d39

                                                                                                                                              SHA256

                                                                                                                                              312cfce641833a5129ea9b92f8f5ea2f1c75c9ed45212309eb65980b6287811e

                                                                                                                                              SHA512

                                                                                                                                              f0f491dd0125624e0d2ec5b32f7bc5ecaca449a1d8faad25753cb9883cdfa132d79e0cf97c5076d86f6e53ccb2f870ea7a77a4e462b92f4ba1c02958beb607da

                                                                                                                                            • \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

                                                                                                                                              Filesize

                                                                                                                                              536KB

                                                                                                                                              MD5

                                                                                                                                              fed4f09f414635deea48e534cc7049ea

                                                                                                                                              SHA1

                                                                                                                                              9b83823df699efa2a4e7797c96c2bb189c9316f6

                                                                                                                                              SHA256

                                                                                                                                              5cd19ee758ae78747927035e88021e2ce9ab79073c11180f07e4f3afa4d5ab08

                                                                                                                                              SHA512

                                                                                                                                              88d14cf05f2063bc35c54fe2f17712b99fb6a95a27e296db0e0a29762f107caa5d47ce19e24989ebe70cb4b49383b9dd2a884860ecec878305ab055358b0f121

                                                                                                                                            • \??\c:\windows\system32\alg.exe

                                                                                                                                              Filesize

                                                                                                                                              577KB

                                                                                                                                              MD5

                                                                                                                                              342cda79523537896a6e086db72b4976

                                                                                                                                              SHA1

                                                                                                                                              2cd706cfd33950a38a3ad37ef68d22755a760c99

                                                                                                                                              SHA256

                                                                                                                                              5ad40ccb7513e110ecab0757aed22c17b567662305e6570e70d70244744fc7ef

                                                                                                                                              SHA512

                                                                                                                                              e6eac3ea706b6fe9db35784a7c03bc172809c4addf4f90b3ede24acc5e719980bb51e9a0d6b31dec92ddf53583af3140b31cb010f35ea28695230aa9bcb25300

                                                                                                                                            • \??\c:\windows\system32\fxssvc.exe

                                                                                                                                              Filesize

                                                                                                                                              1.1MB

                                                                                                                                              MD5

                                                                                                                                              3527fce3314ad99c9a6d37893a46aa0c

                                                                                                                                              SHA1

                                                                                                                                              210568922f7c9ec600b2784585b845a243d6dd11

                                                                                                                                              SHA256

                                                                                                                                              0843a99c8462919569a661f2c7fd111ef8356a05dc99dfd00a92a868dc24e9d7

                                                                                                                                              SHA512

                                                                                                                                              dd0e73e42aa7fb973c752444baa5d6b81de1ebb7c1a5d662e49015cca7d5a86c35993d8851ede46119cc903c5ea6bdb5cd8dc48ffa598e29e35c9d1ba5c094b4

                                                                                                                                            • \??\c:\windows\system32\msdtc.exe

                                                                                                                                              Filesize

                                                                                                                                              638KB

                                                                                                                                              MD5

                                                                                                                                              ec5b14ca3d1fdbbeddc101d33533bbe9

                                                                                                                                              SHA1

                                                                                                                                              da6cb47fd3fb6b2201965f60305a78834f5fe7e7

                                                                                                                                              SHA256

                                                                                                                                              6f5ddfc03f0265c74090146e4af42b2db798e5ae904f0486c0eaa94265d42fb6

                                                                                                                                              SHA512

                                                                                                                                              3613fef1f54d5c92df1c151586f3b3c5f676b5a216265c6080ea75c339edc7d55f77b5de60b04c2a363cc39799b496b815da59edaf6c9c3654aeb75aaeade83c

                                                                                                                                            • \??\c:\windows\system32\msiexec.exe

                                                                                                                                              Filesize

                                                                                                                                              625KB

                                                                                                                                              MD5

                                                                                                                                              4a32898ff900e6d1c82d2870871c0501

                                                                                                                                              SHA1

                                                                                                                                              bbd7ac2f9ffb194d881b537011ce6affa4e962fc

                                                                                                                                              SHA256

                                                                                                                                              073cfdbb8680fc4a2ca1a5a3690cb834d5585f8d33fb2d7a715271c10f106d4d

                                                                                                                                              SHA512

                                                                                                                                              66c61bb663d235430aa3000d87a0da3894d23cf7abdf18c5049bbe803f4941d0920aeb73bd5aa4bf101332a48f6c6a45cc4826ab1cd4e57d8bebb87b5e1591f3

                                                                                                                                            • \??\c:\windows\system32\snmptrap.exe

                                                                                                                                              Filesize

                                                                                                                                              514KB

                                                                                                                                              MD5

                                                                                                                                              411dbd905b71d169c44afa8b3b343d04

                                                                                                                                              SHA1

                                                                                                                                              17fe0b0f3ca09d9fe493ef12c3c934e66b4bce22

                                                                                                                                              SHA256

                                                                                                                                              786977675ea008ad7db2cbacb7df26be50c5b9059e5e14e12e6dfd5346eb5348

                                                                                                                                              SHA512

                                                                                                                                              b2b98b2046f2b30359ca56976287e9afb9d16d0733c7b0164e57c15420f6490f991a7e5eebbf06a2883d9712032dd9de1dcf1b9898e14dc584abadc2f29a4baf

                                                                                                                                            • \??\c:\windows\system32\ui0detect.exe

                                                                                                                                              Filesize

                                                                                                                                              540KB

                                                                                                                                              MD5

                                                                                                                                              e43299c702973e0975432af8a0cb61a7

                                                                                                                                              SHA1

                                                                                                                                              8cb52eb29a258abe5bcb7a73361e6052b281768a

                                                                                                                                              SHA256

                                                                                                                                              33706c0f2f0dbedce0a5eb54302b5bcbfac2768a561a043b3b412f0a2e7e95b1

                                                                                                                                              SHA512

                                                                                                                                              89f8ebdf117d81327c831a581195213ffbd869e82347f292692be46d6b96a06b8072431b07008d366ee33e3ab5c643fa807e2f062648407360ef1faffc435548

                                                                                                                                            • \??\c:\windows\system32\vds.exe

                                                                                                                                              Filesize

                                                                                                                                              1021KB

                                                                                                                                              MD5

                                                                                                                                              f82c29b035a577dd72e5ba8119d8601d

                                                                                                                                              SHA1

                                                                                                                                              f688ad511a190f204b255d7f61cd03559b4907ca

                                                                                                                                              SHA256

                                                                                                                                              0741167897192cae7919b5ee4507670b3b65671cd0fda7c4af44ee8805d03836

                                                                                                                                              SHA512

                                                                                                                                              f66d443127c45a79080dbe8c7ae8cf9a1f6a37297e5d8a55b4ec38babdc492bc1f3e9e6118400e79eaa2cfc60dbb29fcf8a7eb121e52990dfd35e13bf13243cd

                                                                                                                                            • \??\c:\windows\system32\vssvc.exe

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              02077e67c6fde7fd658767bcb3d70d66

                                                                                                                                              SHA1

                                                                                                                                              4c4e40b171f338d9b643863d61901fe6f118327f

                                                                                                                                              SHA256

                                                                                                                                              02b8be582ead5c910a415bc8766b37e81551500e976fa4a0fef4126c7f8078bc

                                                                                                                                              SHA512

                                                                                                                                              1b60b7002c76434e0c198599cf6ef796576952b3ad3cd8534236e24f20cb24708753586cefca923d23e0c16ea31e8d8ea10e9e737993ffe3777a2dd4e4406674

                                                                                                                                            • \??\c:\windows\system32\wbem\wmiApsrv.exe

                                                                                                                                              Filesize

                                                                                                                                              698KB

                                                                                                                                              MD5

                                                                                                                                              41e6a8a2bb25d1b686b046f9bc09177b

                                                                                                                                              SHA1

                                                                                                                                              a28646c2d0afdb11046e44abf330c5e2b54da65f

                                                                                                                                              SHA256

                                                                                                                                              c01e2d9eef9d5bf52609cc26159f97bc7d8aafa084f0692c9db04679bf1ee05c

                                                                                                                                              SHA512

                                                                                                                                              4c02b7141a448994bdae96439ac3dc238957f82dc87585138c9eff2570c92f7d52af11d1472cb53a8034c4329eb0dcd1e08cfde4ad0f6363a1d26e6fddfdf694

                                                                                                                                            • \??\c:\windows\system32\wbengine.exe

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                              MD5

                                                                                                                                              078b101aa8d91a247ee29194ace6c201

                                                                                                                                              SHA1

                                                                                                                                              07e453c836e39c4c91a7fa26ee945606a468bbcf

                                                                                                                                              SHA256

                                                                                                                                              b9da7412c02dbcda04e113d9581e8307a90e91a9945eda6138510c3e9b850f31

                                                                                                                                              SHA512

                                                                                                                                              c881d3c2a27e0e048c5d885a94ae9d5b2139fb8c4c7373a70fc4018a2e5c73f361ae3dbdf70679accae60eb8b970b81580b29bfec1c672312c5a9fa3404ee5ac

                                                                                                                                            • \Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              MD5

                                                                                                                                              bb10cecd167cf72bd1d3e30ea481f9a8

                                                                                                                                              SHA1

                                                                                                                                              2bd5d03cc3dfd07c228e9a63835dbc8931cee0bd

                                                                                                                                              SHA256

                                                                                                                                              fb6344276bd88f751f5f541dfa8f04b7147ba7c5238e03b836e51fa32678e3a6

                                                                                                                                              SHA512

                                                                                                                                              d9cc11e9cc4f72b34740f8b3e10008f0276ef09990a88d69552eb2944b35033bd4607d52f5b75c7fe99b41890d5cec445d5d4748b20752cdf554d7fdd154764d

                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                                                                                                              Filesize

                                                                                                                                              582KB

                                                                                                                                              MD5

                                                                                                                                              6f3b97591778e90be5c31b9d843dcbd2

                                                                                                                                              SHA1

                                                                                                                                              dc4e137751dc7c4c8ef1d6185b37df14af30c78d

                                                                                                                                              SHA256

                                                                                                                                              1fded5e6ed450ab9f7faa7b222961028510ddb4493a01a84876b6a8ab2d7af12

                                                                                                                                              SHA512

                                                                                                                                              3b0048e88e92015bc36531922039e9053bbe61b42bc9dd32a25ba9b4f0c9776439c90cbebfaeb3152826aa409cedab643e904afa63df7aebeba203d43397aeb6

                                                                                                                                            • \Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                                                                                                              Filesize

                                                                                                                                              610KB

                                                                                                                                              MD5

                                                                                                                                              7760e00864ef17d873f7250ae09ff209

                                                                                                                                              SHA1

                                                                                                                                              508f99bc4c05ed792caa7baf78208ea723f80c00

                                                                                                                                              SHA256

                                                                                                                                              b94c27a8fc9da9c8035cdb4fbdd8f9505f0ddeeac8c57040e7ee0e8fcd332692

                                                                                                                                              SHA512

                                                                                                                                              35f4b8487c6b04e53ab8e655ea6a13418fdcbabb100031483050141cbe81ebcbd7a76e92bc60f936ad060fe3190fcfc4b6f921073ffb67b387bc654370e5d4bc

                                                                                                                                            • \Windows\System32\ieetwcollector.exe

                                                                                                                                              Filesize

                                                                                                                                              609KB

                                                                                                                                              MD5

                                                                                                                                              0901605153ef8eace46ff5852e2894cb

                                                                                                                                              SHA1

                                                                                                                                              76b5e789f92d77e8d4d52c62ec5c9da481600a09

                                                                                                                                              SHA256

                                                                                                                                              0ba717f2a178dccc172910f3f1a4c482362e551555d9fb45e83f7af2e1f96cce

                                                                                                                                              SHA512

                                                                                                                                              bcc6deca864f996e0c0709b082aba3a3bc36cf1592474d5363f771986ef887581defb84e1f4f43bef677540d6f4efa013dc0ef133ce8c2c63f9e813beca9e341

                                                                                                                                            • \Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6C5A.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

                                                                                                                                              Filesize

                                                                                                                                              85KB

                                                                                                                                              MD5

                                                                                                                                              5180107f98e16bdca63e67e7e3169d22

                                                                                                                                              SHA1

                                                                                                                                              dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                              SHA256

                                                                                                                                              d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                              SHA512

                                                                                                                                              27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                            • \Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6F08.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

                                                                                                                                              Filesize

                                                                                                                                              298KB

                                                                                                                                              MD5

                                                                                                                                              5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                              SHA1

                                                                                                                                              1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                              SHA256

                                                                                                                                              5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                              SHA512

                                                                                                                                              58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                            • \Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP72C0.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

                                                                                                                                              Filesize

                                                                                                                                              58KB

                                                                                                                                              MD5

                                                                                                                                              3d6987fc36386537669f2450761cdd9d

                                                                                                                                              SHA1

                                                                                                                                              7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                              SHA256

                                                                                                                                              34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                              SHA512

                                                                                                                                              1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                            • \Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP754F.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

                                                                                                                                              Filesize

                                                                                                                                              58KB

                                                                                                                                              MD5

                                                                                                                                              a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                              SHA1

                                                                                                                                              500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                              SHA256

                                                                                                                                              1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                              SHA512

                                                                                                                                              b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                            • \Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP77EE.tmp\Microsoft.Office.Tools.v9.0.dll

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                              MD5

                                                                                                                                              4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                              SHA1

                                                                                                                                              f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                              SHA256

                                                                                                                                              c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                              SHA512

                                                                                                                                              c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                            • \Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7A8D.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

                                                                                                                                              Filesize

                                                                                                                                              87KB

                                                                                                                                              MD5

                                                                                                                                              ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                              SHA1

                                                                                                                                              4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                              SHA256

                                                                                                                                              b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                              SHA512

                                                                                                                                              d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                            • memory/388-451-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1448-220-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1448-89-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1448-168-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1460-82-0x0000000140000000-0x0000000140371000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/1460-152-0x0000000140000000-0x0000000140371000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/1604-172-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1604-150-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1612-304-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1612-301-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1728-299-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1728-302-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1740-369-0x000000001C100000-0x000000001C10C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/1740-372-0x000000001C4B0000-0x000000001C4C6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              88KB

                                                                                                                                            • memory/1740-373-0x000000001C4D0000-0x000000001C518000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              288KB

                                                                                                                                            • memory/1740-389-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1740-379-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/1740-380-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/1740-370-0x000000001C490000-0x000000001C49C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/1740-371-0x000000001C4A0000-0x000000001C4AE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/1740-375-0x000000001C540000-0x000000001C550000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1740-374-0x000000001C520000-0x000000001C53A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/1892-461-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1928-338-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/1928-336-0x000000001C530000-0x000000001C54E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                            • memory/1928-335-0x000000001C510000-0x000000001C52A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/1928-334-0x0000000000970000-0x000000000097E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/1928-332-0x0000000000940000-0x0000000000958000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              96KB

                                                                                                                                            • memory/1968-363-0x00000000006B0000-0x00000000006BC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/1968-365-0x0000000000740000-0x0000000000750000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1968-367-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2000-344-0x00000000008D0000-0x00000000008EA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/2000-341-0x0000000000820000-0x000000000082C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2000-353-0x000000001D2C0000-0x000000001D2D8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              96KB

                                                                                                                                            • memory/2000-352-0x000000001D2C0000-0x000000001D2D8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              96KB

                                                                                                                                            • memory/2000-345-0x0000000003160000-0x000000000317E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                            • memory/2000-343-0x0000000000880000-0x00000000008C8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              288KB

                                                                                                                                            • memory/2000-342-0x0000000000830000-0x000000000083E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2000-340-0x00000000007C0000-0x00000000007D8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              96KB

                                                                                                                                            • memory/2000-362-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2032-171-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2032-173-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2096-306-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2112-412-0x0000000002F60000-0x0000000002F76000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              88KB

                                                                                                                                            • memory/2112-418-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2112-411-0x0000000002F40000-0x0000000002F5A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/2168-309-0x0000000003030000-0x0000000003078000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              288KB

                                                                                                                                            • memory/2168-312-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2168-308-0x0000000000960000-0x000000000096C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2168-307-0x0000000000950000-0x000000000095E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2168-310-0x0000000002F90000-0x0000000002FA6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              88KB

                                                                                                                                            • memory/2264-422-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/2264-417-0x00000000006E0000-0x00000000006F6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              88KB

                                                                                                                                            • memory/2264-416-0x00000000006C0000-0x00000000006DA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/2264-414-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2264-431-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2264-423-0x000000001CCE0000-0x000000001CCFA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/2284-401-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2284-410-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2284-395-0x0000000000790000-0x000000000079C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2284-397-0x000000001C550000-0x000000001C564000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              80KB

                                                                                                                                            • memory/2284-396-0x0000000000810000-0x000000000081C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2284-402-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2288-462-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2288-464-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2288-463-0x00000000005A0000-0x00000000005AA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/2300-390-0x00000000006A0000-0x00000000006AC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2300-391-0x00000000008F0000-0x0000000000904000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              80KB

                                                                                                                                            • memory/2300-393-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2404-322-0x000000001C580000-0x000000001C58E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2404-331-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2404-321-0x000000001C580000-0x000000001C58E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2404-316-0x000000001C470000-0x000000001C4B8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              288KB

                                                                                                                                            • memory/2404-315-0x000000001C460000-0x000000001C46C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/2404-314-0x000000001C100000-0x000000001C10E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2404-317-0x000000001C4C0000-0x000000001C4D6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              88KB

                                                                                                                                            • memory/2444-1-0x0000000000401000-0x0000000000402000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/2444-2-0x0000000000400000-0x00000000005CF000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2444-0-0x0000000000400000-0x00000000005CF000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2644-21-0x0000000010000000-0x00000000101B7000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.7MB

                                                                                                                                            • memory/2644-62-0x0000000010000000-0x00000000101B7000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.7MB

                                                                                                                                            • memory/2644-22-0x000000001000C000-0x000000001000D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/2664-437-0x00000000007B0000-0x00000000007BE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2664-435-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2664-442-0x000000001C580000-0x000000001C58E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2664-450-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2688-56-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2688-57-0x0000000140001000-0x0000000140002000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/2688-151-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2756-63-0x0000000010000000-0x00000000101E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2756-36-0x0000000010000000-0x00000000101E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2756-35-0x0000000010000000-0x00000000101E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2800-433-0x00000000008B0000-0x00000000008BE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/2800-441-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2800-432-0x0000000140000000-0x00000001401E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.9MB

                                                                                                                                            • memory/2980-49-0x0000000000400000-0x00000000005C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB