Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2025-01-31...ry.exe

windows7-x64

10

2025-01-31...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2025, 17:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-31_636791c83174f3dffb8b32ec708a4ff0_wannacry.exe

  • Size

    5.0MB

  • MD5

    636791c83174f3dffb8b32ec708a4ff0

  • SHA1

    8742f643599a52bdab0df2c8bc12ba6d42c03ce9

  • SHA256

    087756bfcf84c96dc757168b24a46f7c69ce985081b1bb8e4b96e26673331229

  • SHA512

    feaa69148c0634231c53012c14100bdb25b25cb5eb118a044da1d4cd13ef18d4eccd8659e58384d327e957f501aff32858403b7208a7b6023bab71cde6969c4e

  • SSDEEP

    98304:5DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HJsgKWH:5DqPe1Cxcxk3ZAEUadzR8yc4HTK

Score
10/10
wannacrydiscoveryransomwarespywarestealerworm

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Contacts a large (2865) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 44 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-31_636791c83174f3dffb8b32ec708a4ff0_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-31_636791c83174f3dffb8b32ec708a4ff0_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:816
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:108
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2148
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2976
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1684
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2852
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 258 -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1f0 -NGENProcess 24c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 244 -NGENProcess 268 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1d8 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1552
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 26c -NGENProcess 1f0 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1904
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 268 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 260 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 280 -NGENProcess 278 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2184
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 24c -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2792
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 268 -NGENProcess 250 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1724
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 268 -NGENProcess 24c -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 260 -NGENProcess 250 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2344
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 284 -NGENProcess 290 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 278 -NGENProcess 250 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 280 -NGENProcess 260 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1556
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 26c -NGENProcess 294 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2156
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2a0 -NGENProcess 250 -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 24c -NGENProcess 290 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:456
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2a8 -NGENProcess 284 -Pipe 2a4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 28c -NGENProcess 294 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1100
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 26c -NGENProcess 21c -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2d0 -NGENProcess 2ac -Pipe 2cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3056
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d4 -NGENProcess 2c0 -Pipe 2c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1716
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2d8 -NGENProcess 21c -Pipe 2bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 26c -NGENProcess 2ac -Pipe 2e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2316
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 21c -NGENProcess 2ac -Pipe 2d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 2e8 -NGENProcess 1e8 -Pipe 2e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1288
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 1e8 -NGENProcess 26c -Pipe 2b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:472
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d4 -NGENProcess 2f4 -Pipe 2e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1724
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f4 -NGENProcess 2ac -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2248
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 1e8 -Pipe 2c4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2288
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 1e8 -NGENProcess 2d4 -Pipe 2dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 300 -NGENProcess 2ac -Pipe 2f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2ac -NGENProcess 2f8 -Pipe 2fc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 308 -NGENProcess 2d4 -Pipe 2f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2296
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2d4 -NGENProcess 300 -Pipe 304 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 310 -NGENProcess 2f8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2932
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2f8 -NGENProcess 308 -Pipe 30c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 2f8 -NGENProcess 310 -Pipe 300 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2028
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 318 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1588
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 21c -NGENProcess 2ac -Pipe 2ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 2ac -NGENProcess 2f8 -Pipe 310 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 328 -NGENProcess 308 -Pipe 2d4 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1064
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 308 -NGENProcess 21c -Pipe 324 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 330 -NGENProcess 2f8 -Pipe 318 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 2f8 -NGENProcess 328 -Pipe 32c -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 308 -NGENProcess 21c -Pipe 33c -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 21c -NGENProcess 330 -Pipe 338 -Comment "NGen Worker Process"
      2⤵
        PID:2280
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 340 -NGENProcess 328 -Pipe 2c0 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2448
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 328 -NGENProcess 308 -Pipe 2ac -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:456
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 348 -NGENProcess 330 -Pipe 2f8 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2640
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 330 -NGENProcess 340 -Pipe 344 -Comment "NGen Worker Process"
        2⤵
          PID:2716
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 350 -NGENProcess 308 -Pipe 21c -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1244
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 308 -NGENProcess 348 -Pipe 34c -Comment "NGen Worker Process"
          2⤵
            PID:1580
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 314 -NGENProcess 35c -Pipe 350 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2972
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 35c -NGENProcess 340 -Pipe 348 -Comment "NGen Worker Process"
            2⤵
            • Modifies data under HKEY_USERS
            PID:2432
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 308 -Pipe 334 -Comment "NGen Worker Process"
            2⤵
              PID:2640
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 328 -Pipe 330 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1700
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 36c -NGENProcess 340 -Pipe 368 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2276
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 314 -NGENProcess 354 -Pipe 370 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2280
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 354 -NGENProcess 364 -Pipe 358 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1556
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 364 -NGENProcess 320 -Pipe 340 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:436
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 328 -NGENProcess 374 -Pipe 360 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1428
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 37c -NGENProcess 36c -Pipe 35c -Comment "NGen Worker Process"
              2⤵
              • Modifies data under HKEY_USERS
              PID:2344
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 364 -NGENProcess 384 -Pipe 328 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1088
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 384 -NGENProcess 354 -Pipe 388 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2004
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 378 -NGENProcess 314 -Pipe 308 -Comment "NGen Worker Process"
              2⤵
                PID:1276
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 38c -NGENProcess 380 -Pipe 374 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3028
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 380 -NGENProcess 364 -Pipe 394 -Comment "NGen Worker Process"
                2⤵
                  PID:1440
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 36c -NGENProcess 390 -Pipe 320 -Comment "NGen Worker Process"
                  2⤵
                    PID:1932
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 398 -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"
                    2⤵
                      PID:1052
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"
                      2⤵
                        PID:548
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 390 -Pipe 384 -Comment "NGen Worker Process"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1908
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 378 -Pipe 38c -Comment "NGen Worker Process"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1136
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 364 -Pipe 380 -Comment "NGen Worker Process"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2564
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 390 -Pipe 36c -Comment "NGen Worker Process"
                        2⤵
                          PID:2828
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 378 -Pipe 398 -Comment "NGen Worker Process"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          PID:1564
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 364 -Pipe 39c -Comment "NGen Worker Process"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2932
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3ac -NGENProcess 3bc -Pipe 3b0 -Comment "NGen Worker Process"
                          2⤵
                            PID:1864
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3a8 -NGENProcess 364 -Pipe 3c0 -Comment "NGen Worker Process"
                            2⤵
                              PID:1596
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 208 -NGENProcess 3b8 -Pipe 3a0 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1612
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 3b4 -NGENProcess 3a8 -Pipe 390 -Comment "NGen Worker Process"
                              2⤵
                                PID:2248
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 3ac -NGENProcess 3c4 -Pipe 208 -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2140
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 364 -NGENProcess 378 -Pipe 20c -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:932
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 3c8 -NGENProcess 3b4 -Pipe 3bc -Comment "NGen Worker Process"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:2496
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3c4 -Pipe 3a4 -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:2468
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 378 -Pipe 314 -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:1436
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3b4 -Pipe 3a8 -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:2100
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3d4 -Pipe 3b4 -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:1716
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3ac -NGENProcess 3d8 -Pipe 364 -Comment "NGen Worker Process"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:1448
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3e0 -NGENProcess 3dc -Pipe 3b8 -Comment "NGen Worker Process"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:992
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 3d4 -Pipe 3c4 -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:1500
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3d8 -Pipe 3c8 -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:1700
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 3dc -Pipe 3cc -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:924
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3e4 -NGENProcess 3f4 -Pipe 3e8 -Comment "NGen Worker Process"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:1464
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3d0 -NGENProcess 3dc -Pipe 3ac -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:1884
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3fc -NGENProcess 3ec -Pipe 3f8 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2552
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3ec -NGENProcess 3e4 -Pipe 3d8 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1136
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3e4 -NGENProcess 3d0 -Pipe 408 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2628
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3d0 -NGENProcess 3f4 -Pipe 404 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1072
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 3d4 -NGENProcess 410 -Pipe 3e4 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:1988
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 410 -NGENProcess 3fc -Pipe 3f4 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2216
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 418 -NGENProcess 3d0 -Pipe 414 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2396
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 378 -NGENProcess 3e0 -Pipe 3dc -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1616
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 3e0 -NGENProcess 410 -Pipe 40c -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:1612
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 420 -NGENProcess 3d0 -Pipe 3f0 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:264
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 41c -Pipe 3d4 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2436
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 410 -Pipe 418 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2948
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 3d0 -Pipe 3ec -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:3036
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 430 -NGENProcess 41c -Pipe 378 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:3004
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 434 -NGENProcess 410 -Pipe 3e0 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2100
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 438 -NGENProcess 3d0 -Pipe 420 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2880
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 430 -NGENProcess 440 -Pipe 434 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2660
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 424 -NGENProcess 3d0 -Pipe 428 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1968
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 444 -NGENProcess 438 -Pipe 3fc -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:1676
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 440 -Pipe 42c -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:896
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 424 -NGENProcess 450 -Pipe 444 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2948
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 430 -NGENProcess 440 -Pipe 454 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1976
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 44c -NGENProcess 458 -Pipe 424 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:1128
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 3d0 -NGENProcess 440 -Pipe 45c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:2668
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 438 -NGENProcess 410 -Pipe 448 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2832
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 460 -NGENProcess 458 -Pipe 450 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:1100
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 44c -NGENProcess 468 -Pipe 438 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2924
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 41c -NGENProcess 440 -Pipe 44c -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:2004
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in Windows directory
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2764
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2872
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 238 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2448
                                                                                    • C:\Windows\ehome\ehRecvr.exe
                                                                                      C:\Windows\ehome\ehRecvr.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2104
                                                                                    • C:\Windows\ehome\ehsched.exe
                                                                                      C:\Windows\ehome\ehsched.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:836
                                                                                    • C:\Windows\eHome\EhTray.exe
                                                                                      "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:1640
                                                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2096
                                                                                    • C:\Windows\system32\IEEtwCollector.exe
                                                                                      C:\Windows\system32\IEEtwCollector.exe /V
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2664
                                                                                    • C:\Windows\ehome\ehRec.exe
                                                                                      C:\Windows\ehome\ehRec.exe -Embedding
                                                                                      1⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1500
                                                                                    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                      "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1664
                                                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1592
                                                                                    • C:\Windows\System32\msdtc.exe
                                                                                      C:\Windows\System32\msdtc.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      PID:2364
                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1560
                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1576
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2025-01-31_636791c83174f3dffb8b32ec708a4ff0_wannacry.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2025-01-31_636791c83174f3dffb8b32ec708a4ff0_wannacry.exe -m security
                                                                                      1⤵
                                                                                      • Drops file in System32 directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:1568
                                                                                    • C:\Windows\SysWow64\perfhost.exe
                                                                                      C:\Windows\SysWow64\perfhost.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1600

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
                                                                                      Filesize

                                                                                      706KB

                                                                                      MD5

                                                                                      94cc59cc8e4d0ad40c015c5f55ecec63

                                                                                      SHA1

                                                                                      27f7246773fc587701f876130631bcbcc0d17353

                                                                                      SHA256

                                                                                      89b6d7bf86cef2ec2bbd121b14cb7b9b993292ea6f2d00cd69f4424cf8b7a22e

                                                                                      SHA512

                                                                                      f4e13cc2b4d11dffc4c7c769df3ebc6cfd36c30e07826a58dc805e29a20a1401e854367e27efaa972c985ae5c0331af7ff036fb61b77fd6a3e4e77db39e6b28b

                                                                                      Download Submit

                                                                                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
                                                                                      Filesize

                                                                                      1.6MB

                                                                                      MD5

                                                                                      d7d40f70431c162abebb6fadc9c71663

                                                                                      SHA1

                                                                                      ec841121221be93d894026f57a37b379520ea371

                                                                                      SHA256

                                                                                      aa727eb27173640ae1794233a7898e545756b75c17c6692f814faa63f911ab72

                                                                                      SHA512

                                                                                      2ce54969e80bfbac0832ba9407c7246ff4c879e3f692b7dc888b88dfd57902e9b58abc0cfea9f9d7faed32de1370007dcbe847da8776fcaf7adc6e93a2b073c9

                                                                                      Download Submit

                                                                                    • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      763d62e5d33c6bd27a3b3b58ad2b3e88

                                                                                      SHA1

                                                                                      7b8b92af2c2d1dfb6328715319b7efe001c08c6d

                                                                                      SHA256

                                                                                      bcb54deeeaae6e7ca3b41cda73eabe39bba17f5c27107208350d3ffb808c6d3a

                                                                                      SHA512

                                                                                      7cd2f5a7f788a398a325167e0b575a8fcc92b9a8df60c53967fc87734992f0404e139debe68502269de102c02dc68992ed2d97cb9f7a13a3a8d0eba2ec4c0d5f

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                      Filesize

                                                                                      706KB

                                                                                      MD5

                                                                                      e050c2c1f44d4c31cc3672852b4d0ba8

                                                                                      SHA1

                                                                                      d291aba1ca474337e7aeecaaa2c558987f56fa55

                                                                                      SHA256

                                                                                      8d678232f5c201c00b29acbb9317fc5e9202d49e2b927f20d814d5f356ba1961

                                                                                      SHA512

                                                                                      0af67ebd6af35d96ad628f65ba48cf07d883ad4e1a03b6a455468a212ac6fbf8642dd1ad30cab25d9e7fe03d989bc5ad6c4b9534e9c3926ffe43fd0ca63fa054

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                      Filesize

                                                                                      30.1MB

                                                                                      MD5

                                                                                      92793c4416d4d7cb2914b4ac0dd4f857

                                                                                      SHA1

                                                                                      14b2c573cb54ff29d6ff761f4ecf9c401f358002

                                                                                      SHA256

                                                                                      f3f389d71e711a768d41e2cff2903769da6f0f7343e159177abd675b8005f897

                                                                                      SHA512

                                                                                      0a29aef9f6212debf0eb713c089c739438de23b72f5c7946e69885364b9f2145763e62d8473cc124a46e2c8ebdf23a0912cff069ae03941d8c82d7ca655d0d4b

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                      Filesize

                                                                                      781KB

                                                                                      MD5

                                                                                      6bf2573efc6d3708618b8cd37217fb33

                                                                                      SHA1

                                                                                      14eaf78fdd70321feb486d5314f2e9a8ebd930f2

                                                                                      SHA256

                                                                                      5cffbef1731e3ef3326be9210e5dfcfce74f360a61105201b26d656578d55292

                                                                                      SHA512

                                                                                      d23f1e522f4bfaecb928a85667fb75295c1999f4b14115b4b83623391868b530fc148c97a80d6e13ece0895515ce08d10b14910ed1fbbd841f516cf5880c9934

                                                                                      Download Submit

                                                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                      Filesize

                                                                                      2.1MB

                                                                                      MD5

                                                                                      bb95e13d3fd1b984565b5f74a2d40cd0

                                                                                      SHA1

                                                                                      787ed010a75f494e5b615c578152f9d774e71b1e

                                                                                      SHA256

                                                                                      2709861f042986f133bfc37165514d8157b5d021bcebc0d0df77f32c77a74053

                                                                                      SHA512

                                                                                      71a1b2a035a4c0aa364980660a4dfc400ac4a84fffa3fb6731af0c0d76ea7e1e42818e62b429d88a283c82c8c876b641623792d3864a247f7cf1b272c86f7fb7

                                                                                      Download Submit

                                                                                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                      Filesize

                                                                                      872KB

                                                                                      MD5

                                                                                      31dc3519edd118dc8271b603f3def5a0

                                                                                      SHA1

                                                                                      8fc2b0d7711c5fb4017fe0b246521696da7a6f61

                                                                                      SHA256

                                                                                      44a47538df15f80371f8a404a69f1e3115bf70b5a38df95e7b7a6bb58cdc0c2e

                                                                                      SHA512

                                                                                      5cfabfb518db98f04aed11c952b9d7a7b5234ed7354a7a34b7a87a7eeceb2309c8972da44582068bfee3769ab1ea85d617cd23c92c1eb36ec5d74533d12313a7

                                                                                      Download Submit

                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      Filesize

                                                                                      678KB

                                                                                      MD5

                                                                                      97c12c8b5bfff552dbf97117cacf24d1

                                                                                      SHA1

                                                                                      d70e1aac30ab96051a603486b454eff23dc16893

                                                                                      SHA256

                                                                                      5d40547150c9a244f181978beee1467a1ccf2450d565fd609dd8af462f3786fe

                                                                                      SHA512

                                                                                      1898df16fa2765edc8cdcdc86610dcdbba7cc0c964de6becd4b431ebb7576aa95ed27e977a31d223c898df19af257f4b06b0e813a2395cbb30f87843ff80de84

                                                                                      Download Submit

                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                      Filesize

                                                                                      625KB

                                                                                      MD5

                                                                                      8bae3663a8152818c6aa4b381d374b69

                                                                                      SHA1

                                                                                      8c3c2e0d91729edcbe5d2ab84e474e458014e841

                                                                                      SHA256

                                                                                      75532f6f4f28ac140a8143330a3f7b42f243f8aa871f7e0f21115209c9632af4

                                                                                      SHA512

                                                                                      a56cbc7f8c2105d9dcc9b1f71010889018973014ae94dad5eba144399c84809f451b885fb0ca485eab5ccae28a99f54a8cf4b14996b0d22623b7017504b47bc6

                                                                                      Download Submit

                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                      Filesize

                                                                                      1003KB

                                                                                      MD5

                                                                                      d5b66b25d1f8fc02cb3807572aaaf7bb

                                                                                      SHA1

                                                                                      23ca7eb724b4956d68c8bddd079668498b1b5161

                                                                                      SHA256

                                                                                      b631e6e74ba21b8e6b9dae48474b178138b206cfb5787e287e8aad45e377b34e

                                                                                      SHA512

                                                                                      f63da828a16a304d2aa3d60496314eb69da3438d843ad33cce2b4e815cb0a7ae577000c9b8a8d5a9f9d9db83b5a98270e5d27251683b5701913e95816837b0c6

                                                                                      Download Submit

                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      Filesize

                                                                                      656KB

                                                                                      MD5

                                                                                      067949c21ec18dc254aa963c50738fb2

                                                                                      SHA1

                                                                                      ef292f5764ffb67728e1e773126c8bf780d1c62f

                                                                                      SHA256

                                                                                      8710fed93108b547f97e98f0b31dadaced1bb0d3219fdc6584ea3d32330a14f7

                                                                                      SHA512

                                                                                      a40b652b17c2f1b3eaed5ab2e3b08761459b23d4b648bf1463bd17c481803430a5ac9667a42fb87c8524d85ac75dce7af56cc5e476b84369f6ad98515d5790f3

                                                                                      Download Submit

                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      29e2c687648da1723649f2099f044151

                                                                                      SHA1

                                                                                      f51c7fe0e80b5d43d89542105ba0af2ea91e53e0

                                                                                      SHA256

                                                                                      9a3761340565d1da1a23c2a4fb78dcf08a920f7b828a9b5c2b8b85f835d29b09

                                                                                      SHA512

                                                                                      4aab53cc0c5bbcbeb1ccab2e0e84b3589571b881615bcc712416b4dbe0e6aaa19a518ad86888eada9eb6ebdc9a6d0198bbae01d3926e067dee6aef70623dbab9

                                                                                      Download Submit

                                                                                    • C:\Windows\SysWOW64\perfhost.exe
                                                                                      Filesize

                                                                                      587KB

                                                                                      MD5

                                                                                      5553bd518eb3a1cf48dd987713a0feec

                                                                                      SHA1

                                                                                      f2fc7a18768fe639f8f46dd7b27928714a3aea8a

                                                                                      SHA256

                                                                                      0a72b1aaadf509dd9d22ef9019bf9abb72e4aa8f627ae505c647d066cd84e565

                                                                                      SHA512

                                                                                      d6b5383f8bc40c0ec26f621690b84bdc89cb14bc4bdabf6f6a6b21efef427d0d247b4f839b1fc5071be7d2ed2a5437b873f5b4a0647fbf093071571ee77e72ab

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                      Filesize

                                                                                      834KB

                                                                                      MD5

                                                                                      c76656b09bb7df6bd2ac1a6177a0027c

                                                                                      SHA1

                                                                                      0c296994a249e8649b19be84dce27c9ddafef3e0

                                                                                      SHA256

                                                                                      a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0

                                                                                      SHA512

                                                                                      8390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                      Filesize

                                                                                      797KB

                                                                                      MD5

                                                                                      aeb0b6e6c5d32d1ada231285ff2ae881

                                                                                      SHA1

                                                                                      1f04a1c059503896336406aed1dc93340e90b742

                                                                                      SHA256

                                                                                      4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263

                                                                                      SHA512

                                                                                      e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                      Filesize

                                                                                      163KB

                                                                                      MD5

                                                                                      e88828b5a35063aa16c68ffb8322215d

                                                                                      SHA1

                                                                                      8225660ba3a9f528cf6ac32038ae3e0ec98d2331

                                                                                      SHA256

                                                                                      99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142

                                                                                      SHA512

                                                                                      e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      006498313e139299a5383f0892c954b9

                                                                                      SHA1

                                                                                      7b3aa10930da9f29272154e2674b86876957ce3a

                                                                                      SHA256

                                                                                      489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c

                                                                                      SHA512

                                                                                      6a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                      Filesize

                                                                                      148KB

                                                                                      MD5

                                                                                      ac901cf97363425059a50d1398e3454b

                                                                                      SHA1

                                                                                      2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

                                                                                      SHA256

                                                                                      f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

                                                                                      SHA512

                                                                                      6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                      Filesize

                                                                                      34KB

                                                                                      MD5

                                                                                      c26b034a8d6ab845b41ed6e8a8d6001d

                                                                                      SHA1

                                                                                      3a55774cf22d3244d30f9eb5e26c0a6792a3e493

                                                                                      SHA256

                                                                                      620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

                                                                                      SHA512

                                                                                      483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                      Filesize

                                                                                      109KB

                                                                                      MD5

                                                                                      0fd0f978e977a4122b64ae8f8541de54

                                                                                      SHA1

                                                                                      153d3390416fdeba1b150816cbbf968e355dc64f

                                                                                      SHA256

                                                                                      211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60

                                                                                      SHA512

                                                                                      ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\23976c621e7c0c6fcd9f2b985bf76e70\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                      Filesize

                                                                                      83KB

                                                                                      MD5

                                                                                      46e7a916db69879e839e0351a13347b9

                                                                                      SHA1

                                                                                      bd727ef3377b7cff710af102ec662be212077116

                                                                                      SHA256

                                                                                      925acc9e9bbd7bfcb5845c54bfe254ebb86c1e123bd4151b45608a4551025120

                                                                                      SHA512

                                                                                      27c123030b857f12befe8adb1387e1f847156430518e90c821b8a5f2b9faec48357d7e60e85a250f07b63036d6669068fd9de32795330b8e4b26ef0112c5adcc

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                      Filesize

                                                                                      41KB

                                                                                      MD5

                                                                                      3c269caf88ccaf71660d8dc6c56f4873

                                                                                      SHA1

                                                                                      f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

                                                                                      SHA256

                                                                                      de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

                                                                                      SHA512

                                                                                      bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                      Filesize

                                                                                      210KB

                                                                                      MD5

                                                                                      4f40997b51420653706cb0958086cd2d

                                                                                      SHA1

                                                                                      0069b956d17ce7d782a0e054995317f2f621b502

                                                                                      SHA256

                                                                                      8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

                                                                                      SHA512

                                                                                      e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                      Filesize

                                                                                      53KB

                                                                                      MD5

                                                                                      e3a7a2b65afd8ab8b154fdc7897595c3

                                                                                      SHA1

                                                                                      b21eefd6e23231470b5cf0bd0d7363879a2ed228

                                                                                      SHA256

                                                                                      e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

                                                                                      SHA512

                                                                                      6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a372e947959b7856363b142c87685a58\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                      Filesize

                                                                                      180KB

                                                                                      MD5

                                                                                      b017e0cbe745275de1d0b7e3eab3d875

                                                                                      SHA1

                                                                                      13d65e5f31ce6149c2cb3bc7bc3a4f58f6075193

                                                                                      SHA256

                                                                                      281d72dd4e67092098282e89d241e6238ea584212e385e1f186c0f1fbdc5fa0b

                                                                                      SHA512

                                                                                      ed6d8bef94118fc9428cc6a78dec486040679e16ef3dcdc74002ed5cd497e0a64a8f0f808d2ece4e267d1aa2abfb6e8704c2225d05c3a80776fe0a076cea9ca1

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                      Filesize

                                                                                      28KB

                                                                                      MD5

                                                                                      aefc3f3c8e7499bad4d05284e8abd16c

                                                                                      SHA1

                                                                                      7ab718bde7fdb2d878d8725dc843cfeba44a71f7

                                                                                      SHA256

                                                                                      4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

                                                                                      SHA512

                                                                                      1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      9c60454398ce4bce7a52cbda4a45d364

                                                                                      SHA1

                                                                                      da1e5de264a6f6051b332f8f32fa876d297bf620

                                                                                      SHA256

                                                                                      edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

                                                                                      SHA512

                                                                                      533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                      Filesize

                                                                                      57KB

                                                                                      MD5

                                                                                      6eaaa1f987d6e1d81badf8665c55a341

                                                                                      SHA1

                                                                                      e52db4ad92903ca03a5a54fdb66e2e6fad59efd5

                                                                                      SHA256

                                                                                      4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e

                                                                                      SHA512

                                                                                      dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                      Filesize

                                                                                      130KB

                                                                                      MD5

                                                                                      2735d2ab103beb0f7c1fbd6971838274

                                                                                      SHA1

                                                                                      6063646bc072546798bf8bf347425834f2bfad71

                                                                                      SHA256

                                                                                      f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

                                                                                      SHA512

                                                                                      fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f030ae7a0ac8395493f8afcd319ee692\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                      Filesize

                                                                                      143KB

                                                                                      MD5

                                                                                      f786ebe6116b55d4dc62a63dfede2ca6

                                                                                      SHA1

                                                                                      ab82f3b24229cf9ad31484b3811cdb84d5e916e9

                                                                                      SHA256

                                                                                      9805ae745d078fc9d64e256d4472c0edd369958a6872d71bd28d245a0239fe12

                                                                                      SHA512

                                                                                      80832872329611c5c68784196f890859f6f7c5795f6a62542ad20be813e587341b36ade410363646c43f9ced48d2cf89a4537fe60d90e868324270f7040c2738

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                      Filesize

                                                                                      59KB

                                                                                      MD5

                                                                                      8c69bbdfbc8cc3fa3fa5edcd79901e94

                                                                                      SHA1

                                                                                      b8028f0f557692221d5c0160ec6ce414b2bdf19b

                                                                                      SHA256

                                                                                      a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

                                                                                      SHA512

                                                                                      825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f55ab64dfa7b6ac770d70a964950cadd\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                      Filesize

                                                                                      187KB

                                                                                      MD5

                                                                                      06cd1251d648810ae276724b53273f69

                                                                                      SHA1

                                                                                      f68ce06d2e9ace07d69e00d0d0dcb6bcba313a52

                                                                                      SHA256

                                                                                      a4365ce4dea7848b2fc444e87894334ded1075369a143f63df37e9c0c950c124

                                                                                      SHA512

                                                                                      5f0eb52df33f752d077bd36d103f60d7c44b6ed2f5504adb703ca2f69a1b3f773cf6ed06e88a1e42455bba8c8c35b426d2862da2f347916ae75af7ba21c09e81

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                      Filesize

                                                                                      42KB

                                                                                      MD5

                                                                                      71d4273e5b77cf01239a5d4f29e064fc

                                                                                      SHA1

                                                                                      e8876dea4e4c4c099e27234742016be3c80d8b62

                                                                                      SHA256

                                                                                      f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

                                                                                      SHA512

                                                                                      41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
                                                                                      Filesize

                                                                                      855KB

                                                                                      MD5

                                                                                      7812b0a90d92b4812d4063b89a970c58

                                                                                      SHA1

                                                                                      3c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea

                                                                                      SHA256

                                                                                      897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543

                                                                                      SHA512

                                                                                      634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed

                                                                                      Download Submit

                                                                                    • C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
                                                                                      Filesize

                                                                                      43KB

                                                                                      MD5

                                                                                      3e72bdd0663c5b2bcd530f74139c83e3

                                                                                      SHA1

                                                                                      66069bcac0207512b9e07320f4fa5934650677d2

                                                                                      SHA256

                                                                                      6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

                                                                                      SHA512

                                                                                      b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

                                                                                      Download Submit

                                                                                    • C:\Windows\system32\fxssvc.exe
                                                                                      Filesize

                                                                                      1.2MB

                                                                                      MD5

                                                                                      610dc2445cc7e59ac4bdf8f5836447da

                                                                                      SHA1

                                                                                      f7e3ff33f6122c0afb178f1933f6edc52bbce773

                                                                                      SHA256

                                                                                      9826aad3a434ddb7dbda8103a58fdae0dd471f8079f9bdc1712c6e1309cd681a

                                                                                      SHA512

                                                                                      1f7ac8e3ee1f7ed78334387abaf20b660728fdc2d58f6fc8b444ecb8db93d68d84c4e1da6376e3f9afdbc0887827f111dca9aceccf9e0ab1d55b41ee2dfdb576

                                                                                      Download Submit

                                                                                    • C:\Windows\tasksche.exe
                                                                                      Filesize

                                                                                      3.4MB

                                                                                      MD5

                                                                                      7f7ccaa16fb15eb1c7399d422f8363e8

                                                                                      SHA1

                                                                                      bd44d0ab543bf814d93b719c24e90d8dd7111234

                                                                                      SHA256

                                                                                      2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

                                                                                      SHA512

                                                                                      83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

                                                                                      Download Submit

                                                                                    • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                      Filesize

                                                                                      648KB

                                                                                      MD5

                                                                                      98e39abe72d48e1f60400b27d44e73e5

                                                                                      SHA1

                                                                                      66213f5d9551e4609ae8cbd901ddc9f8025d8aa8

                                                                                      SHA256

                                                                                      fe0035aac6e8a7d60dffb59d4d45e279c019635ecc5cefdbef219f7b32a61986

                                                                                      SHA512

                                                                                      0a12e1e6ddfb81f1c994782afd8fb68e61cdb2794ec8e9e1cba3db09efc3760e778b584e63e218a0d696e404bba22e6ad3a395932b65db343586b2cdfeea772f

                                                                                      Download Submit

                                                                                    • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                      Filesize

                                                                                      603KB

                                                                                      MD5

                                                                                      e8f1511055ff60eac3e787eb26fb0b91

                                                                                      SHA1

                                                                                      68bcba39f27ed4c9bc68d7dbbc4e0dc61a94e0b5

                                                                                      SHA256

                                                                                      4c4c237d66ea00751206c9ae411a8017380efdf1d4054d0f52349d3831bf761b

                                                                                      SHA512

                                                                                      d1003f3fed0ca4f92500dece1f55b6fffaa238d85232eefab32b403838979575ca006d17f5f391209b3ca1a0ec7c991aa99e3d57e60696cbe25e65464ae4ab81

                                                                                      Download Submit

                                                                                    • \Windows\System32\alg.exe
                                                                                      Filesize

                                                                                      644KB

                                                                                      MD5

                                                                                      e202e0dd25c3d48b01e263fb6934cde0

                                                                                      SHA1

                                                                                      5490240feb1c460d4fb94b8b14640250a208d1a3

                                                                                      SHA256

                                                                                      eaed98ce7788308e2f08dbad5e745ebd233b3882daa2b1b9419bc7f79931b312

                                                                                      SHA512

                                                                                      3f2c40acf8fbbed45ea6374d4234e7cd6398bc1782162b39db9ce42980c786e4dadd6c1f79fccd20a52680dae4a270aa8c731b198fe0c1d9f02affca357840f6

                                                                                      Download Submit

                                                                                    • \Windows\System32\ieetwcollector.exe
                                                                                      Filesize

                                                                                      674KB

                                                                                      MD5

                                                                                      99f72da1af11891f3bc956e9c9b90425

                                                                                      SHA1

                                                                                      6fec8356de85627e55dff47564a0740887f4aeee

                                                                                      SHA256

                                                                                      9774d4f52761236a066e9d9391c2dcd2a99a656d67cddc3b9e2607ce77858be8

                                                                                      SHA512

                                                                                      524810381e883f39ede2eb9aaafd1fc003fefa329437c9a57eff81f43e137d3188d3f6682db2c309fdfee28513aa818d38739d9cdad0fa9a648e6a55140a6036

                                                                                      Download Submit

                                                                                    • \Windows\System32\msdtc.exe
                                                                                      Filesize

                                                                                      705KB

                                                                                      MD5

                                                                                      f17be6bcbfbd51d7c5b6eaaa87905226

                                                                                      SHA1

                                                                                      d314ce698ee54b4549d4de56c8c915a7ed319be0

                                                                                      SHA256

                                                                                      272f491d0fa7614110d239318d517d6d73282a4fb0484cca757d077998084b0f

                                                                                      SHA512

                                                                                      1ceb349b7208928171a8c98f86ff1cda3fa26b92f4885b3e6ec395d23befdc128ec65632707e3279372c97f994c5137ce5d6464f7c71614d02b73035e7381451

                                                                                      Download Submit

                                                                                    • \Windows\System32\msiexec.exe
                                                                                      Filesize

                                                                                      691KB

                                                                                      MD5

                                                                                      9022ab7e026e46cececa0b7cc2647d38

                                                                                      SHA1

                                                                                      8e59af92c7c8b1b30c375d10db8b42f8e6e0c1f2

                                                                                      SHA256

                                                                                      a83552bc5ac825aca052ee2ba753e9405cfe240d74b497dcf6bbc40f92e21e7f

                                                                                      SHA512

                                                                                      c866cc6abdb6ea700f8c28fe3ed6b2237c7afb6055cd305b028c4a678805aed5bae5d3f2fed0d936339695ebe8707dbd084b8e87ae40cea978d6b3204fa0a40c

                                                                                      Download Submit

                                                                                    • \Windows\ehome\ehrecvr.exe
                                                                                      Filesize

                                                                                      1.2MB

                                                                                      MD5

                                                                                      4be4afc6c8a980f5c2c1fa52f82155e9

                                                                                      SHA1

                                                                                      5116dc03623847d2ef4ca4ff09509b71e3f5497e

                                                                                      SHA256

                                                                                      dc000eb6a66d991f7a45422c7a04cb54746e332570d0667b28784cb92b915747

                                                                                      SHA512

                                                                                      0aab4db109105c50cc43d0700bdd36cf751140c980cbb4ad1ad6cd92a18508cfeb0f4761f09f30cae0a715d2d57fc222d54c79f8044a3b729168741968b0e52d

                                                                                      Download Submit

                                                                                    • \Windows\ehome\ehsched.exe
                                                                                      Filesize

                                                                                      691KB

                                                                                      MD5

                                                                                      bfae366374f3816f90a000ad59b0ef1a

                                                                                      SHA1

                                                                                      c9708d3ca84579e714b96fa3097aadb2bc6c7899

                                                                                      SHA256

                                                                                      813953384876455f51856c2a2efbf156e8aa79a93afcf0fb965cd4f530c94185

                                                                                      SHA512

                                                                                      7359cd91c095334de23fbdc18350d63da83bbeedcbe6ad97fdf8789a62d3a72a5fd1afc912e4c2190f42cf9bc10301008f220f9b37b6e8dd71bf5da761ba56c9

                                                                                      Download Submit

                                                                                    • memory/456-654-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/456-640-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/524-402-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/524-356-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/816-52-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                      Filesize

                                                                                      7.0MB

                                                                                      Download

                                                                                    • memory/816-5-0x0000000000B00000-0x0000000000B67000-memory.dmp

                                                                                      Filesize

                                                                                      412KB

                                                                                      Download

                                                                                    • memory/816-249-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                      Filesize

                                                                                      7.0MB

                                                                                      Download

                                                                                    • memory/816-0-0x0000000000B00000-0x0000000000B67000-memory.dmp

                                                                                      Filesize

                                                                                      412KB

                                                                                      Download

                                                                                    • memory/816-8-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                      Filesize

                                                                                      7.0MB

                                                                                      Download

                                                                                    • memory/836-111-0x0000000000820000-0x0000000000880000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/836-105-0x0000000000820000-0x0000000000880000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/836-104-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/836-578-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/836-187-0x0000000140000000-0x00000001400B2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/876-359-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/876-575-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/876-327-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1072-444-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1072-413-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1100-677-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1532-672-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1532-652-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1552-493-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1552-478-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1556-626-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1560-347-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/1560-191-0x0000000000570000-0x0000000000622000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/1560-188-0x0000000100000000-0x00000001000B2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/1560-384-0x0000000000570000-0x0000000000622000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/1568-455-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                      Filesize

                                                                                      7.0MB

                                                                                      Download

                                                                                    • memory/1568-232-0x0000000000400000-0x0000000000AFA000-memory.dmp

                                                                                      Filesize

                                                                                      7.0MB

                                                                                      Download

                                                                                    • memory/1576-231-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                      Filesize

                                                                                      724KB

                                                                                      Download

                                                                                    • memory/1576-414-0x000000002E000000-0x000000002E0B5000-memory.dmp

                                                                                      Filesize

                                                                                      724KB

                                                                                      Download

                                                                                    • memory/1592-164-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                      Filesize

                                                                                      808KB

                                                                                      Download

                                                                                    • memory/1592-152-0x0000000140000000-0x00000001400CA000-memory.dmp

                                                                                      Filesize

                                                                                      808KB

                                                                                      Download

                                                                                    • memory/1600-242-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                      Filesize

                                                                                      600KB

                                                                                      Download

                                                                                    • memory/1600-476-0x0000000001000000-0x0000000001096000-memory.dmp

                                                                                      Filesize

                                                                                      600KB

                                                                                      Download

                                                                                    • memory/1612-481-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1612-456-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1664-150-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                      Filesize

                                                                                      30.1MB

                                                                                      Download

                                                                                    • memory/1664-230-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                      Filesize

                                                                                      30.1MB

                                                                                      Download

                                                                                    • memory/1684-72-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                      Filesize

                                                                                      636KB

                                                                                      Download

                                                                                    • memory/1684-37-0x0000000000450000-0x00000000004B7000-memory.dmp

                                                                                      Filesize

                                                                                      412KB

                                                                                      Download

                                                                                    • memory/1684-30-0x0000000000450000-0x00000000004B7000-memory.dmp

                                                                                      Filesize

                                                                                      412KB

                                                                                      Download

                                                                                    • memory/1684-29-0x0000000010000000-0x000000001009F000-memory.dmp

                                                                                      Filesize

                                                                                      636KB

                                                                                      Download

                                                                                    • memory/1696-605-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1724-556-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1832-601-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/1904-512-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2092-502-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2092-517-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2096-124-0x00000000008D0000-0x0000000000930000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2096-118-0x00000000008D0000-0x0000000000930000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2096-126-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                      Filesize

                                                                                      2.2MB

                                                                                      Download

                                                                                    • memory/2096-190-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                      Filesize

                                                                                      2.2MB

                                                                                      Download

                                                                                    • memory/2104-711-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                      Filesize

                                                                                      1.2MB

                                                                                      Download

                                                                                    • memory/2104-184-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                      Filesize

                                                                                      1.2MB

                                                                                      Download

                                                                                    • memory/2104-92-0x0000000000240000-0x00000000002A0000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2104-115-0x0000000000C30000-0x0000000000C40000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                      Download

                                                                                    • memory/2104-98-0x0000000000240000-0x00000000002A0000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2104-116-0x0000000000C40000-0x0000000000C50000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                      Download

                                                                                    • memory/2104-91-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                      Filesize

                                                                                      1.2MB

                                                                                      Download

                                                                                    • memory/2148-12-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                      Download

                                                                                    • memory/2148-21-0x0000000000170000-0x00000000001D0000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2148-13-0x0000000000170000-0x00000000001D0000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2148-103-0x0000000100000000-0x00000001000A4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                      Download

                                                                                    • memory/2156-630-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2156-624-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2184-534-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2344-590-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2344-579-0x0000000003BE0000-0x0000000003C9A000-memory.dmp

                                                                                      Filesize

                                                                                      744KB

                                                                                      Download

                                                                                    • memory/2344-574-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2364-264-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                      Filesize

                                                                                      728KB

                                                                                      Download

                                                                                    • memory/2364-172-0x0000000140000000-0x00000001400B6000-memory.dmp

                                                                                      Filesize

                                                                                      728KB

                                                                                      Download

                                                                                    • memory/2448-696-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2448-703-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2580-649-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2664-208-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2664-139-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2664-706-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2760-726-0x0000000001C20000-0x0000000001CC4000-memory.dmp

                                                                                      Filesize

                                                                                      656KB

                                                                                      Download

                                                                                    • memory/2760-731-0x0000000001C20000-0x0000000001C44000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                      Download

                                                                                    • memory/2760-722-0x0000000001C20000-0x0000000001C2A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                      Download

                                                                                    • memory/2760-727-0x0000000001EA0000-0x000000000203E000-memory.dmp

                                                                                      Filesize

                                                                                      1.6MB

                                                                                      Download

                                                                                    • memory/2760-728-0x0000000001C20000-0x0000000001D0C000-memory.dmp

                                                                                      Filesize

                                                                                      944KB

                                                                                      Download

                                                                                    • memory/2760-729-0x0000000001C20000-0x0000000001C30000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                      Download

                                                                                    • memory/2760-730-0x0000000001C20000-0x0000000001CA8000-memory.dmp

                                                                                      Filesize

                                                                                      544KB

                                                                                      Download

                                                                                    • memory/2760-725-0x0000000001C20000-0x0000000001CAC000-memory.dmp

                                                                                      Filesize

                                                                                      560KB

                                                                                      Download

                                                                                    • memory/2760-732-0x0000000001C20000-0x0000000001C28000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                      Download

                                                                                    • memory/2760-166-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2760-724-0x0000000001C20000-0x0000000001C3A000-memory.dmp

                                                                                      Filesize

                                                                                      104KB

                                                                                      Download

                                                                                    • memory/2760-53-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2760-54-0x0000000000390000-0x00000000003F7000-memory.dmp

                                                                                      Filesize

                                                                                      412KB

                                                                                      Download

                                                                                    • memory/2760-723-0x0000000001C20000-0x0000000001C3E000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                      Download

                                                                                    • memory/2760-59-0x0000000000390000-0x00000000003F7000-memory.dmp

                                                                                      Filesize

                                                                                      412KB

                                                                                      Download

                                                                                    • memory/2764-75-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2764-81-0x00000000001E0000-0x0000000000240000-memory.dmp

                                                                                      Filesize

                                                                                      384KB

                                                                                      Download

                                                                                    • memory/2764-171-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2764-74-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2792-532-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2792-552-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2852-44-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                      Filesize

                                                                                      668KB

                                                                                      Download

                                                                                    • memory/2852-83-0x0000000010000000-0x00000000100A7000-memory.dmp

                                                                                      Filesize

                                                                                      668KB

                                                                                      Download

                                                                                    • memory/2872-700-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2872-679-0x0000000140000000-0x00000001400AE000-memory.dmp

                                                                                      Filesize

                                                                                      696KB

                                                                                      Download

                                                                                    • memory/2888-516-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2888-529-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/2976-130-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                      Filesize

                                                                                      628KB

                                                                                      Download

                                                                                    • memory/2976-26-0x0000000140000000-0x000000014009D000-memory.dmp

                                                                                      Filesize

                                                                                      628KB

                                                                                      Download

                                                                                    • memory/3012-329-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/3012-209-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download

                                                                                    • memory/3036-417-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                                      Filesize

                                                                                      672KB

                                                                                      Download