Overview

overview

7

Static

static

3

af03f74df8...d6.exe

windows7-x64

7

af03f74df8...d6.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    18-02-2025 08:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af03f74df8e3b76ca5641528df6c9363aadfe29f0b2970875171a24c2314aed6.exe

  • Size

    1.3MB

  • MD5

    6c10bf48c02d85d1fbfc527728f070e3

  • SHA1

    96869d102a0f35dcb8f2d7941f5359e1e77d4677

  • SHA256

    af03f74df8e3b76ca5641528df6c9363aadfe29f0b2970875171a24c2314aed6

  • SHA512

    6a213ae5b15487f483f6acf218ee3bb7fed49228a973a09248348532277012bd815aa8e0cbf1f4873ad951ba758c7b0d829cbc99e6640416c672e6eba9442373

  • SSDEEP

    24576:vIXgCWSpRy4dSJVDsVu5unzqWvX1JsqjnhMgeiCl7G0nehbGZpbD:uWSjLSJlsQuzqW/1NDmg27RnWGj

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\af03f74df8e3b76ca5641528df6c9363aadfe29f0b2970875171a24c2314aed6.exe
    "C:\Users\Admin\AppData\Local\Temp\af03f74df8e3b76ca5641528df6c9363aadfe29f0b2970875171a24c2314aed6.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2540
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2372
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2784
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:2116
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2644
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3004
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1056
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 24c -NGENProcess 250 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 24c -NGENProcess 1d8 -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1664
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 268 -NGENProcess 250 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 264 -NGENProcess 260 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:836
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 270 -NGENProcess 254 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:236
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1d8 -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2316
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 274 -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1736
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2432
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 264 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:928
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 254 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2852
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 260 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 264 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 254 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2228
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 260 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2944
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 264 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:924
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 254 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 260 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 298 -NGENProcess 2a8 -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2456
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 28c -NGENProcess 260 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 2a0 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 1c8 -NGENProcess 220 -Pipe 2b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2200
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 2d0 -NGENProcess 294 -Pipe 2cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1952
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d4 -NGENProcess 2c0 -Pipe 2c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2480
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2a8 -NGENProcess 220 -Pipe 2dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2bc -NGENProcess 2d8 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2792
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2d8 -NGENProcess 2d4 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2904
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2e8 -NGENProcess 2bc -Pipe 2c4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2360
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2bc -NGENProcess 2e0 -Pipe 2d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1472
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2f0 -NGENProcess 2d4 -Pipe 2d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2060
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d4 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1468
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1856
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2132
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2e4 -NGENProcess 2fc -Pipe 2bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1320
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2fc -NGENProcess 2f8 -Pipe 220 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3060
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 308 -NGENProcess 2f0 -Pipe 2d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1064
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2f0 -NGENProcess 2e4 -Pipe 304 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1252
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 310 -NGENProcess 2f8 -Pipe 2e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2f8 -NGENProcess 308 -Pipe 30c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2680
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 318 -NGENProcess 2e4 -Pipe 2fc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2736
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 2f8 -NGENProcess 314 -Pipe 1c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3056
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 300 -NGENProcess 31c -Pipe 2f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2360
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f8 -NGENProcess 2e4 -Pipe 320 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2808
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e8 -NGENProcess 324 -Pipe 310 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2700
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 324 -NGENProcess 300 -Pipe 31c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1468
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 330 -NGENProcess 2e4 -Pipe 318 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 2e8 -NGENProcess 338 -Pipe 324 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 328 -NGENProcess 2e4 -Pipe 2f8 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3004
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 334 -NGENProcess 340 -Pipe 2e8 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:948
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 314 -NGENProcess 2e4 -Pipe 308 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2604
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 2e4 -NGENProcess 33c -Pipe 328 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2632
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 348 -NGENProcess 340 -Pipe 32c -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 340 -NGENProcess 314 -Pipe 344 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 350 -NGENProcess 33c -Pipe 334 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2588
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 348 -NGENProcess 358 -Pipe 340 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 300 -NGENProcess 33c -Pipe 2e4 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1264
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 33c -NGENProcess 354 -Pipe 350 -Comment "NGen Worker Process"
      2⤵
      • Modifies data under HKEY_USERS
      PID:2728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 360 -NGENProcess 358 -Pipe 330 -Comment "NGen Worker Process"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3060
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 35c -Pipe 34c -Comment "NGen Worker Process"
      2⤵
        PID:2432
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 354 -Pipe 348 -Comment "NGen Worker Process"
        2⤵
          PID:1124
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 358 -Pipe 338 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2976
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 358 -NGENProcess 364 -Pipe 35c -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2740
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 364 -NGENProcess 300 -Pipe 354 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2476
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 378 -NGENProcess 370 -Pipe 360 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2696
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 374 -Pipe 368 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:2800
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 300 -Pipe 36c -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:520
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 370 -Pipe 360 -Comment "NGen Worker Process"
          2⤵
            PID:2000
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 374 -Pipe 358 -Comment "NGen Worker Process"
            2⤵
              PID:1628
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 380 -NGENProcess 390 -Pipe 384 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3068
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 364 -NGENProcess 374 -Pipe 378 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2064
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 394 -NGENProcess 388 -Pipe 314 -Comment "NGen Worker Process"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2560
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 390 -Pipe 37c -Comment "NGen Worker Process"
              2⤵
                PID:2192
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 374 -Pipe 300 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1296
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 388 -Pipe 38c -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2308
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 390 -Pipe 380 -Comment "NGen Worker Process"
                2⤵
                  PID:2264
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 374 -Pipe 364 -Comment "NGen Worker Process"
                  2⤵
                    PID:2604
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 388 -Pipe 394 -Comment "NGen Worker Process"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:988
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 390 -Pipe 398 -Comment "NGen Worker Process"
                    2⤵
                    • Modifies data under HKEY_USERS
                    PID:3008
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 374 -Pipe 39c -Comment "NGen Worker Process"
                    2⤵
                      PID:2992
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 388 -Pipe 3a0 -Comment "NGen Worker Process"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2116
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 11c -NGENProcess 3ac -Pipe 3c0 -Comment "NGen Worker Process"
                      2⤵
                        PID:1804
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 11c -InterruptEvent 374 -NGENProcess 3bc -Pipe 370 -Comment "NGen Worker Process"
                        2⤵
                          PID:1596
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3a8 -NGENProcess 3b4 -Pipe 3b8 -Comment "NGen Worker Process"
                          2⤵
                            PID:1816
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3a4 -NGENProcess 3ac -Pipe 118 -Comment "NGen Worker Process"
                            2⤵
                              PID:608
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3c4 -NGENProcess 3bc -Pipe 3b0 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1368
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3b4 -Pipe 390 -Comment "NGen Worker Process"
                              2⤵
                              • Modifies data under HKEY_USERS
                              PID:2756
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3ac -Pipe 11c -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:1940
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3a4 -NGENProcess 3bc -Pipe 3d4 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:1632
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3a4 -NGENProcess 3cc -Pipe 3d0 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:1572
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3cc -NGENProcess 3a4 -Pipe 3a8 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:2924
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3dc -NGENProcess 3c8 -Pipe 3b4 -Comment "NGen Worker Process"
                              2⤵
                              • Modifies data under HKEY_USERS
                              PID:2312
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 388 -Pipe 3d8 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:3020
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 3a4 -Pipe 3c4 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2744
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3c8 -Pipe 3bc -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:1276
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 388 -Pipe 374 -Comment "NGen Worker Process"
                              2⤵
                              • Modifies data under HKEY_USERS
                              PID:1096
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 3a4 -Pipe 3cc -Comment "NGen Worker Process"
                              2⤵
                              • Modifies data under HKEY_USERS
                              PID:2928
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 3c8 -Pipe 3dc -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:1444
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 388 -Pipe 3e0 -Comment "NGen Worker Process"
                              2⤵
                              • Loads dropped DLL
                              • Drops file in Windows directory
                              • Modifies data under HKEY_USERS
                              PID:432
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 388 -NGENProcess 3f0 -Pipe 3a4 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:2416
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 404 -NGENProcess 3c8 -Pipe 3e8 -Comment "NGen Worker Process"
                              2⤵
                              • Loads dropped DLL
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:2228
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 388 -NGENProcess 40c -Pipe 3f8 -Comment "NGen Worker Process"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:1860
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 3ec -NGENProcess 3c8 -Pipe 3f4 -Comment "NGen Worker Process"
                              2⤵
                              • Loads dropped DLL
                              • Drops file in Windows directory
                              • Modifies data under HKEY_USERS
                              PID:2308
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3c8 -NGENProcess 404 -Pipe 408 -Comment "NGen Worker Process"
                              2⤵
                                PID:1196
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 414 -NGENProcess 40c -Pipe 3fc -Comment "NGen Worker Process"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                PID:392
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 410 -Pipe 3e4 -Comment "NGen Worker Process"
                                2⤵
                                  PID:3008
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 410 -NGENProcess 3c8 -Pipe 404 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1528
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3c8 -NGENProcess 414 -Pipe 424 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:576
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3ac -NGENProcess 420 -Pipe 3ec -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1644
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 428 -NGENProcess 418 -Pipe 3f0 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:1356
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 270 -NGENProcess 414 -Pipe 1f0 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1816
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 26c -Pipe 21c -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1780
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2972
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:2660
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:604
                                          • C:\Windows\ehome\ehRecvr.exe
                                            C:\Windows\ehome\ehRecvr.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Modifies data under HKEY_USERS
                                            PID:1748
                                          • C:\Windows\ehome\ehsched.exe
                                            C:\Windows\ehome\ehsched.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1064
                                          • C:\Windows\eHome\EhTray.exe
                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:1756
                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:2328
                                          • C:\Windows\system32\IEEtwCollector.exe
                                            C:\Windows\system32\IEEtwCollector.exe /V
                                            1⤵
                                            • Executes dropped EXE
                                            PID:2588
                                          • C:\Windows\ehome\ehRec.exe
                                            C:\Windows\ehome\ehRec.exe -Embedding
                                            1⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1700
                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                            "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                            1⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            PID:940
                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1124
                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:784
                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1508

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            feeadd341279e3cd12783e0e99bfacd1

                                            SHA1

                                            616ff6e791e9e611bfe097fc6352ee476a6eeda6

                                            SHA256

                                            f2777dc8b0adb3eb855cfe4a7df7c05052c904e6ff6e0855ba226174b7974ba2

                                            SHA512

                                            d3b8bdd1f9e3b8d03bd34d9a09fd475b4af5a5d1dfeb8ec6d3c2cda03137071f9fa5d04655fd0ad07aed2ae4f0da5709b0483e70f06f6232665d152ad71a25bd

                                            Download Submit

                                          • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
                                            Filesize

                                            1.6MB

                                            MD5

                                            f0b09ad0abe17e6e24039768e4db4ad3

                                            SHA1

                                            a5be566d6e7196d04c311223991509640089807c

                                            SHA256

                                            162042f395c979afe0df1093d4eeb473680ab9af327cb03f3d323c8b3b5099d4

                                            SHA512

                                            4bed7e3c6df1194b420e0933c78b61f64bd072680350a21753f89b98cab5909f28b2f2c9e66687dcdacc46cf0c26350327abecf562dae14c4eb9c4efb9013c8c

                                            Download Submit

                                          • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
                                            Filesize

                                            1.3MB

                                            MD5

                                            e40d444bdd4fd487a655d899b7486b4e

                                            SHA1

                                            fdc4d7d8501970eed2ffd8dc5d5816eb26c68353

                                            SHA256

                                            70d6c7714f5e7db4ef7e65ad1bac746f3c0bd2ce1b6a60d0a8e20093185977db

                                            SHA512

                                            ca5ee75d0791d85d3a26665a9748673830a375db4bcf031d9d9dfd402d2d7116d4c87912d26f27759beb0ba9c33f8207e5aa0703fa8004fa50b6956d5c0c9a9a

                                            Download Submit

                                          • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            5bfcb6c4b0809f18249d7c3690bdd191

                                            SHA1

                                            c1ed43f631f3c89731d74300d6fe8a59ac97f439

                                            SHA256

                                            296f4f60f635f4a795705dcd5f2d3da12a4d8ae2153839d788098fb2e92a8f36

                                            SHA512

                                            751fe163c1683654fc19f99a52c301e47446ea98a3a8b7da9e509c19c639f9d7b68fa7bc9e44e6d3b2d2ac7d40df62168f28e37a04197580cc9447dc4c2dd8f7

                                            Download Submit

                                          • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                            Filesize

                                            1.3MB

                                            MD5

                                            eb704686cd5347005485122e040e74be

                                            SHA1

                                            0101b2464d01fb35f959b5a7de4807db4b9c1d65

                                            SHA256

                                            8c4f2dc5601753504eee7ebc534d9ca2fcb56908418ab9d54f7245b5cdd97231

                                            SHA512

                                            56d0251fedf41ff127624ba0d5772798c8b249afcb77ea6d5045a8e1a007008244ffc9ec5190ad9f14c3034b8803816bf7d8cb7fac00bf41f43c23b2d5f045a5

                                            Download Submit

                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                            Filesize

                                            30.1MB

                                            MD5

                                            1a839628c3411c38b02e47e95ec02399

                                            SHA1

                                            58f7aa83f83afbe5a28ba2cebeeb639295000572

                                            SHA256

                                            fbe15687fc2dfe0e76d52e56961932422738640e017a9459c88b4d6ea3332254

                                            SHA512

                                            941fe33f2e0a76725c2b74de27230fa976b82b03d0c5b55b9ff09a32517a578ed58abae74320408aba5d4379fc12c6762bd4d92381d75fca25fc37539aed1290

                                            Download Submit

                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                            Filesize

                                            1.4MB

                                            MD5

                                            5352a49ff39899c7d90114ef233d78bf

                                            SHA1

                                            83f7904c20d5a581a5a90ff6659d061cb2cae037

                                            SHA256

                                            9ffe94b1db78b057a1122d689ee57be230f2e0b2162fb689f24ca3a95b65b3f8

                                            SHA512

                                            9908637581ba3be8bf05ac1326784a3702edd4a7b1d17c13194af5e21b6a3e2252dac5e6c9ed0c1f7de97794672020964976f678f730daf25ddec951a967a0c7

                                            Download Submit

                                          • C:\Program Files\7-Zip\7z.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            252ab93d092e2c3dd615b0ab0099a34f

                                            SHA1

                                            fe2da16c44125670b6396f7637a285308cc7396b

                                            SHA256

                                            44d4da5e8dd76940c8fb5e69e64d21abca6ff818f9ee81b25a4ffae23aaae256

                                            SHA512

                                            a4f64e811b91d54d30a9145da56ab250a18bfd83be8cff317c0368c123113a90eb36015596d426b90210093186d3fbc17e595cfc14a2ba965f3e994c45a57984

                                            Download Submit

                                          • C:\Program Files\7-Zip\7zFM.exe
                                            Filesize

                                            1.5MB

                                            MD5

                                            2163359cc5deae1beb6e85126b7cadc7

                                            SHA1

                                            e687e7abb9bc52ad8f976d2f2a80e394a3647bff

                                            SHA256

                                            46b10c16c3764883d0ed74d1e8d4d47da503195691d2a0f820bfc898fd7fa6c9

                                            SHA512

                                            53099125f644032dc580c9af01bd68088bce588e1eb7f63a18a39d8473bc48d99e21a5d7e588f709714407e56b982fb24be96876a4899c6a33965cc3db393b17

                                            Download Submit

                                          • C:\Program Files\7-Zip\7zG.exe
                                            Filesize

                                            1.2MB

                                            MD5

                                            9c117effd2bf9298d7d3e57cf5c17c2e

                                            SHA1

                                            1442e7f30d291abf780191c109e810f374d29021

                                            SHA256

                                            d736d4ccb40bf0a04e97ea16e937aa81d710beb2d1c7170550f4846a9823cb22

                                            SHA512

                                            8432cd72d4dd673d4ccb3a66679cdd66fb5e3c5f42dad2081f61f20c515ed7869bf792dfd77abca1d628edd8fe7babc2ac96033590c6a37b8f6b8409538f49a8

                                            Download Submit

                                          • C:\Program Files\7-Zip\Uninstall.exe
                                            Filesize

                                            1.2MB

                                            MD5

                                            a681d8ea80550031ab7e1cd3354481fc

                                            SHA1

                                            c561c13240ad3f3bd778c5667f2681643d651959

                                            SHA256

                                            5bc0d66f58aee9e39e7a32f55209fa6e08316799014186e17614d15b8b75d8ac

                                            SHA512

                                            2c8eb6a44f2b8d105d03135eaf228b1e18e43048b9c055f418957999971bcf976100bcd79acfc0ec2cde9c562315c75019dfa62101eed97296beb308d2a5614f

                                            Download Submit

                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                            Filesize

                                            5.2MB

                                            MD5

                                            8471c088142b9fd6dfc8e98832229a2e

                                            SHA1

                                            8f6afbb8399dfaeb5b8ce598b595a4bd44155dd3

                                            SHA256

                                            cccd515d5b6e499d13abbcf1f3e57b229a4a6fc057c7a7fe89fbf858a9aff344

                                            SHA512

                                            6e705de440ccf3711a437ae8ac9c49f4769f6bd15a7be08093b865a57862d7f417e3a4ce50259169b10dd2d657a61bf9cc1d13a6e1f432cfb0ec4774e8c076d9

                                            Download Submit

                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                            Filesize

                                            4.8MB

                                            MD5

                                            247177759a0dd69fee415260d402e435

                                            SHA1

                                            d2184258cf90b22c7c755efa692a574118ed38ce

                                            SHA256

                                            dbe1586d72f854db6e1305575d429dc0df9a59360ec0a684071243bd10436a3d

                                            SHA512

                                            2b38865355a096876cffe9bbeca3d88723bdfc2d9e7f4ace2d873de1dbaee12145b748595b943b4c9e361db8c8e4df78c8703b710f8ffb369eaabbc1b1601e42

                                            Download Submit

                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
                                            Filesize

                                            2.2MB

                                            MD5

                                            f973b61c9f74e56e90657aa6e721d737

                                            SHA1

                                            15d32342b07e77f33419a2d76680fcebe179c079

                                            SHA256

                                            f9692198e343d158ca59b2fdfae5b11a22e8231eb883cedd555ca5f29b04cc09

                                            SHA512

                                            d56cbf04e0ce4346d4a9743b33f585848cc684e66f2555b0c40d9fbbd64e56c6c5de1c1e127bb938e4b78af4d5428b654218daa48768dd0b7256aeefa422a80a

                                            Download Submit

                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                            Filesize

                                            2.1MB

                                            MD5

                                            3d7cf5c21929835b9c5625bea32f1be6

                                            SHA1

                                            9ea67ae427a706867407f310d58fcd0df11cb50d

                                            SHA256

                                            482837caf43088228a75c365e21e3d93cf56c186b58c3ffc543e846ccaee7a79

                                            SHA512

                                            e7e1914289c1cf8c310a8d4b3ba2c21aa2a7a5e7843f0c33b99533735ae60232a7a68ff9ebbba0425771f2189925776bc2cf9fb08bca0e6a1016cbe6188a8171

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\jusched.log
                                            Filesize

                                            1KB

                                            MD5

                                            78eb60637b81fdb26a0c3bf174f15548

                                            SHA1

                                            7b3711ff3346ac075518f8c42c57b5586674a814

                                            SHA256

                                            4423cee51907361a381d87b8a5b210980151854d4781c7781365d52615313f8e

                                            SHA512

                                            2c191074eeec232d85f100412968c1447777d9e2ddcad2ae617708be0c3e563b985e3a97ca726aead0a4304c63efc6214b44ce69b64610b484805128aa6b81a2

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                            Filesize

                                            24B

                                            MD5

                                            b9bd716de6739e51c620f2086f9c31e4

                                            SHA1

                                            9733d94607a3cba277e567af584510edd9febf62

                                            SHA256

                                            7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                            SHA512

                                            cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                            Download Submit

                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            db89b955b600fedb074953a37a6e7d62

                                            SHA1

                                            32e9c102af0819c6f6c12cf8ac31b3606c356dcc

                                            SHA256

                                            c17115a4bfbb22831d7228233e7931ce666d9a0206f0d140c3da21e9cee4272f

                                            SHA512

                                            74ceaebd66ffc7e42bb3bd77f60fda82e9e0d933b83d47d5ba9d259cbb89788b3356d2abf7915e88395b98b226cb2f056ef4ef1efd1292b20dd2e7e0314b1653

                                            Download Submit

                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                            Filesize

                                            872KB

                                            MD5

                                            269772991596a9970d624facba691c9c

                                            SHA1

                                            f13535345f92b818625258b211b1ed820141531b

                                            SHA256

                                            d7e14535c4349d3827e70181107119e8e2a350d4612df408671309f59d595a24

                                            SHA512

                                            21a9914646cb66fda3c2584efc13382ff3fb77fea1c1a5887d7914e60a39ef6db99f5932581535aa1116283bc36e53a71591f27c3718acf903dfbb07a0bcd92b

                                            Download Submit

                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            a1f3473e41e8bbcbffcf382960f37d2d

                                            SHA1

                                            4b69b9b5e2f942fda689c5c4e811602e3236663d

                                            SHA256

                                            5c99d80771c1b4fad2d03f2017f395b7f21dad2ade698ca4bd1283a76fbedc30

                                            SHA512

                                            2d8e4a0cb2d33199c9621490e5da8fc64f8d249487823459cd846809832132afe8da612e8b77ea77165142dec4d1dbaba952cd073216c26ed481c618a11f2476

                                            Download Submit

                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                            Filesize

                                            1.2MB

                                            MD5

                                            816219e387373ced273cd88c2ab9c694

                                            SHA1

                                            a547b3313561ae548423754951caa7b0a510cea7

                                            SHA256

                                            74009394dcc880c6bc0772e927e74f91e21e6e1415b7df2f30eb3b7bfbc2c2f2

                                            SHA512

                                            05bfa705beeaa6b7bf374d90d6e2bf00c5468818490af7797cac915b47f0b68a81d02111bf44ac5af0c10eefcaaa9a6f579d2d40083f07d99365ca07a3ffe49e

                                            Download Submit

                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                            Filesize

                                            1003KB

                                            MD5

                                            9b8cf8aa1d91b1d7ef4c1f25a82ad911

                                            SHA1

                                            829e6bc3d24128406211472b258b845674662245

                                            SHA256

                                            3e284fe1adb4ce3f438455345a63636f61b4b6d2ce9077d2f0950d04bb288fe6

                                            SHA512

                                            8706146f20f0b77fa9c0f8faff36f60132ff31548ce083df034c16cc1088148f56602ec908f090501642c2b74442949b8e9b36744aca1ab0fa2a2430d36ae819

                                            Download Submit

                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            571d8d7d25079ab62d70b69f16a3769f

                                            SHA1

                                            7fddba8ed8c3020337b0e2821503d5240d28b698

                                            SHA256

                                            68e23366019906f2690645898dc92a7e3acc30ab4765981618d31adf91bc24fc

                                            SHA512

                                            f002972626b768b3be175fc3f7d21f6269563394d5f21d958d7efd4cf3d5fd73b4e9ae93938c2855eea0a950a5dba22a669c7fd19828fa87ec3eed26ed76bc64

                                            Download Submit

                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                                            Filesize

                                            8KB

                                            MD5

                                            6bba21814607401625abb44e917aed05

                                            SHA1

                                            180936b9fe6d0e67410759405d95b60715b89bc2

                                            SHA256

                                            68c85f1fd557d3c783b60a63a1ac3e35d8f5846557dc7ac9439a1fb6f8d23bb4

                                            SHA512

                                            6d5c4d51fb25b5fd1e3159e977ccbcad7281a009b7fa313e0868290ac66dfc79875de06f2be727b516c3f5d3133ac427859f7e8a16fc50138b33cbfa89701360

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                            Filesize

                                            797KB

                                            MD5

                                            aeb0b6e6c5d32d1ada231285ff2ae881

                                            SHA1

                                            1f04a1c059503896336406aed1dc93340e90b742

                                            SHA256

                                            4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263

                                            SHA512

                                            e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                            Filesize

                                            163KB

                                            MD5

                                            e88828b5a35063aa16c68ffb8322215d

                                            SHA1

                                            8225660ba3a9f528cf6ac32038ae3e0ec98d2331

                                            SHA256

                                            99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142

                                            SHA512

                                            e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                            Filesize

                                            1.3MB

                                            MD5

                                            006498313e139299a5383f0892c954b9

                                            SHA1

                                            7b3aa10930da9f29272154e2674b86876957ce3a

                                            SHA256

                                            489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c

                                            SHA512

                                            6a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                                            Filesize

                                            148KB

                                            MD5

                                            ac901cf97363425059a50d1398e3454b

                                            SHA1

                                            2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

                                            SHA256

                                            f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

                                            SHA512

                                            6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                            Filesize

                                            109KB

                                            MD5

                                            0fd0f978e977a4122b64ae8f8541de54

                                            SHA1

                                            153d3390416fdeba1b150816cbbf968e355dc64f

                                            SHA256

                                            211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60

                                            SHA512

                                            ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\1289dd8ddfa2e4ebd7cecbbccb16a136\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                            Filesize

                                            83KB

                                            MD5

                                            9cff22abfd3bf16235906615b2d5c13c

                                            SHA1

                                            18d0afbcaa99e33ce43a19c620b1536a06553407

                                            SHA256

                                            bb4177d7920c536eb371287602dd423a670deaac19e394ba106d0f13e98195b2

                                            SHA512

                                            fce4a46a788de053ef40ee4c4e887cbbb9fc6a5b00c39d913d5a868ea5ab5dc0057914010ffc1bce58e4a69f8d65631bd6f97fb44e199b382aafdb54a8716634

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\298480a0a0bcdcb846741a3fddb601fc\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                            Filesize

                                            143KB

                                            MD5

                                            46e20a1b50f43bc879ac16eb41fc8db3

                                            SHA1

                                            8c1543e32905653c4543e753a64aa4cb3a814947

                                            SHA256

                                            9a0ce0eaadb6910a4e8d33089ad9d56c77218c662d547ef5c713ad2d021d53aa

                                            SHA512

                                            6525e2697416505c2f376f810b746beb101913bce3783d5dca683f2a34c1008110787987885d49a63dd606cec85b4011daa504548708e72992a5c09150d50d9d

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                            Filesize

                                            41KB

                                            MD5

                                            3c269caf88ccaf71660d8dc6c56f4873

                                            SHA1

                                            f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

                                            SHA256

                                            de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

                                            SHA512

                                            bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                            Filesize

                                            210KB

                                            MD5

                                            4f40997b51420653706cb0958086cd2d

                                            SHA1

                                            0069b956d17ce7d782a0e054995317f2f621b502

                                            SHA256

                                            8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

                                            SHA512

                                            e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                            Filesize

                                            53KB

                                            MD5

                                            e3a7a2b65afd8ab8b154fdc7897595c3

                                            SHA1

                                            b21eefd6e23231470b5cf0bd0d7363879a2ed228

                                            SHA256

                                            e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

                                            SHA512

                                            6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                            Filesize

                                            28KB

                                            MD5

                                            aefc3f3c8e7499bad4d05284e8abd16c

                                            SHA1

                                            7ab718bde7fdb2d878d8725dc843cfeba44a71f7

                                            SHA256

                                            4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

                                            SHA512

                                            1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\d36d5faf337c14ca97417ad2d1b160d9\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                            Filesize

                                            180KB

                                            MD5

                                            93d0775e417ce3677d7f01cee57f5140

                                            SHA1

                                            6c178349e4b6d3026732ed5186a1fe0860bc1e9b

                                            SHA256

                                            aca40c4be1ac4db099f03389d34da9764f226ecbfab53dbf15ca43f04ad93bc5

                                            SHA512

                                            267e573ebb93e1e2f0dae8777525e2975a259cc3f013e3e3815ebeaf688354401fbdc03775b12c0a7348595aa60d3ec3b9147079ebd6f383b832f2f66857e266

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                            Filesize

                                            27KB

                                            MD5

                                            9c60454398ce4bce7a52cbda4a45d364

                                            SHA1

                                            da1e5de264a6f6051b332f8f32fa876d297bf620

                                            SHA256

                                            edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

                                            SHA512

                                            533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                            Filesize

                                            57KB

                                            MD5

                                            6eaaa1f987d6e1d81badf8665c55a341

                                            SHA1

                                            e52db4ad92903ca03a5a54fdb66e2e6fad59efd5

                                            SHA256

                                            4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e

                                            SHA512

                                            dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ec63708428bdb7f4eba12c56ec4ca07f\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                            Filesize

                                            187KB

                                            MD5

                                            e696fd4cca834dde8e77280c1fff09e2

                                            SHA1

                                            9a94a70e40d92848864e6cf80583b40e65a78b05

                                            SHA256

                                            cb2f4a9bcfb8a44a361f01b29e20c1b8e7dcffcda0e0af27a4dae4d8db12b471

                                            SHA512

                                            b99d54ebdc3da272c9bf2c110e58ffa975619fe48c883bc1464d739088f089ee198dd61e1e6502fe0ffb1cc7adcf72ab6acacf4548390432ac662d909c5ca49a

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                            Filesize

                                            130KB

                                            MD5

                                            2735d2ab103beb0f7c1fbd6971838274

                                            SHA1

                                            6063646bc072546798bf8bf347425834f2bfad71

                                            SHA256

                                            f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

                                            SHA512

                                            fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                            Filesize

                                            59KB

                                            MD5

                                            8c69bbdfbc8cc3fa3fa5edcd79901e94

                                            SHA1

                                            b8028f0f557692221d5c0160ec6ce414b2bdf19b

                                            SHA256

                                            a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

                                            SHA512

                                            825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                            Filesize

                                            42KB

                                            MD5

                                            71d4273e5b77cf01239a5d4f29e064fc

                                            SHA1

                                            e8876dea4e4c4c099e27234742016be3c80d8b62

                                            SHA256

                                            f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

                                            SHA512

                                            41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9000.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
                                            Filesize

                                            34KB

                                            MD5

                                            c26b034a8d6ab845b41ed6e8a8d6001d

                                            SHA1

                                            3a55774cf22d3244d30f9eb5e26c0a6792a3e493

                                            SHA256

                                            620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

                                            SHA512

                                            483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPFE3C.tmp\Microsoft.Office.Tools.Word.v9.0.dll
                                            Filesize

                                            834KB

                                            MD5

                                            c76656b09bb7df6bd2ac1a6177a0027c

                                            SHA1

                                            0c296994a249e8649b19be84dce27c9ddafef3e0

                                            SHA256

                                            a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0

                                            SHA512

                                            8390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
                                            Filesize

                                            855KB

                                            MD5

                                            7812b0a90d92b4812d4063b89a970c58

                                            SHA1

                                            3c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea

                                            SHA256

                                            897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543

                                            SHA512

                                            634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed

                                            Download Submit

                                          • C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
                                            Filesize

                                            43KB

                                            MD5

                                            3e72bdd0663c5b2bcd530f74139c83e3

                                            SHA1

                                            66069bcac0207512b9e07320f4fa5934650677d2

                                            SHA256

                                            6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

                                            SHA512

                                            b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

                                            Download Submit

                                          • C:\Windows\ehome\ehsched.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            38c531c3e18b3d359ecbcaa2f78ebe17

                                            SHA1

                                            1a332f7397f2366ce2f38e62f81ae7acfd11de99

                                            SHA256

                                            4bf1476e107e038750a1c1a74f78544ecf8c6a46e1f3ca2cfb54a41c847a8357

                                            SHA512

                                            07686f89726d1c7146c82e6a7950ddb8925e7bcf5c228581922918479f821545ee0aea879d316370de5a63e4334de9ba3d0f0450ea1fa810af49b1428a54b9c2

                                            Download Submit

                                          • C:\Windows\system32\fxssvc.exe
                                            Filesize

                                            1.2MB

                                            MD5

                                            70ae6de34d821f158fa811efe7c896ff

                                            SHA1

                                            1d7626d42b078db7266d975b331e178c97717bac

                                            SHA256

                                            7471afdb4b9f9cb04e42b71bbac7ca34d62a57bff0bc9a241fcef0f528adddc6

                                            SHA512

                                            3080cc4588014f4ba9adc279f5e7178db4308f7d87995eb57084323f7fd25c2cd265cbc0e56c5cb5bc4c7447a7339ae779b1d5cea30b4cff267fd97a89b733bb

                                            Download Submit

                                          • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                            Filesize

                                            1.2MB

                                            MD5

                                            2fc40ae59d8e09059a4362a4bb91b333

                                            SHA1

                                            b954a14c5c6f67082f62ca28192f235f6d664669

                                            SHA256

                                            602e4a05d1e7717eb9fada73870f7e1a7ab17f9e6565e8afd180e791f987203d

                                            SHA512

                                            f94a637da528d0908bb09cc258d99a30c176f62e518f37df93ea5824cff67dbec07d467c988f574ddc9e0aad9b19ee0535b95be4e4897cf5746f06c1252a67a2

                                            Download Submit

                                          • \Windows\System32\alg.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            69c0b6ccfc64f60073e3ac0a73c2b58c

                                            SHA1

                                            f304b7aa3b29b8b70c0be268a0274386e255e61e

                                            SHA256

                                            43cb92cafc2b0eeb19e0da00f0092a3d2986bdab7b7d171e613aecb457c8d456

                                            SHA512

                                            8f41ecf84bd177081501ffab477bd2686bf70976c30243c4cee05a9b331b79ed288de1ed8d00f256f0a0c5142ceee5a5ece0da99699ceca3faa639121626616a

                                            Download Submit

                                          • \Windows\System32\ieetwcollector.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            958d1be7dfc270dfa5ff4da521a55a11

                                            SHA1

                                            c55e4f731370aaf31a6c288ab71388ec56b8f8fa

                                            SHA256

                                            ce34c5c4592b19cf9769b1849f1cd667a9593ea3e6ca0c1bba4dfde86dd4d3d2

                                            SHA512

                                            5d6cb1b9bff0f71a522e02271bb9920cb6162fc69f4e951cc32e9b59ba3eff2f44e67000ba509bf945db82e1274b84449f1875b3ebedac885e7213a9a1a87f72

                                            Download Submit

                                          • \Windows\ehome\ehrecvr.exe
                                            Filesize

                                            1.2MB

                                            MD5

                                            8d834d33b09e4d4d88c6bf32791b09de

                                            SHA1

                                            ce9cb80071e0bb0c84a744d0de056f82c9bd7cca

                                            SHA256

                                            1ac3cb8f0a44c93fe712fe27d5cd99716c0407545b914c296b6acdccbad023a8

                                            SHA512

                                            1bfcdcc96f76c112d8fbfde4b09b6e72725acba3aa777cdd8394f231aeb49042eecf21eab9d7ae3c77c12f8a26563fcc52bd4896b15d9c990d7f355e8ddb7aa7

                                            Download Submit

                                          • memory/236-463-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/784-387-0x000000002E000000-0x000000002E1F4000-memory.dmp

                                            Filesize

                                            2.0MB

                                            Download

                                          • memory/784-185-0x000000002E000000-0x000000002E1F4000-memory.dmp

                                            Filesize

                                            2.0MB

                                            Download

                                          • memory/836-435-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/836-451-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/888-535-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/888-540-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/924-593-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/928-522-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/928-509-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/940-160-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                            Filesize

                                            30.1MB

                                            Download

                                          • memory/940-356-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                            Filesize

                                            30.1MB

                                            Download

                                          • memory/1056-370-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1056-357-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1064-118-0x00000000008A0000-0x0000000000900000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/1064-292-0x0000000140000000-0x00000001401F1000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1064-620-0x0000000140000000-0x00000001401F1000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1064-120-0x0000000140000000-0x00000001401F1000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1064-112-0x00000000008A0000-0x0000000000900000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/1124-171-0x0000000140000000-0x0000000140209000-memory.dmp

                                            Filesize

                                            2.0MB

                                            Download

                                          • memory/1124-183-0x0000000140000000-0x0000000140209000-memory.dmp

                                            Filesize

                                            2.0MB

                                            Download

                                          • memory/1508-393-0x0000000100000000-0x0000000100542000-memory.dmp

                                            Filesize

                                            5.3MB

                                            Download

                                          • memory/1508-197-0x0000000100000000-0x0000000100542000-memory.dmp

                                            Filesize

                                            5.3MB

                                            Download

                                          • memory/1640-508-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1664-425-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1664-408-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1736-486-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/1748-107-0x0000000001380000-0x0000000001390000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1748-97-0x0000000140000000-0x000000014013C000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/1748-283-0x0000000140000000-0x000000014013C000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/1748-675-0x0000000140000000-0x000000014013C000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/1748-98-0x0000000000430000-0x0000000000490000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/1748-104-0x0000000000430000-0x0000000000490000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/1748-108-0x0000000001390000-0x00000000013A0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2016-413-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2016-372-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2116-46-0x0000000000230000-0x0000000000297000-memory.dmp

                                            Filesize

                                            412KB

                                            Download

                                          • memory/2116-61-0x0000000010000000-0x00000000101DE000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2116-36-0x0000000000230000-0x0000000000297000-memory.dmp

                                            Filesize

                                            412KB

                                            Download

                                          • memory/2116-35-0x0000000010000000-0x00000000101DE000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2228-571-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2268-609-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2316-474-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2316-462-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2328-130-0x00000000002E0000-0x0000000000340000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/2328-132-0x0000000140000000-0x0000000140237000-memory.dmp

                                            Filesize

                                            2.2MB

                                            Download

                                          • memory/2328-294-0x0000000140000000-0x0000000140237000-memory.dmp

                                            Filesize

                                            2.2MB

                                            Download

                                          • memory/2328-124-0x00000000002E0000-0x0000000000340000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/2372-27-0x0000000000870000-0x00000000008D0000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/2372-111-0x0000000100000000-0x00000001001E3000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2372-18-0x0000000100000000-0x00000001001E3000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2372-20-0x0000000000870000-0x00000000008D0000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/2432-485-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2432-497-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2456-615-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2456-631-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2540-1-0x0000000000240000-0x00000000002A7000-memory.dmp

                                            Filesize

                                            412KB

                                            Download

                                          • memory/2540-8-0x0000000000240000-0x00000000002A7000-memory.dmp

                                            Filesize

                                            412KB

                                            Download

                                          • memory/2540-0-0x0000000000400000-0x0000000000546000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2540-88-0x0000000000400000-0x0000000000546000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2540-148-0x0000000000400000-0x0000000000546000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2588-145-0x0000000140000000-0x00000001401ED000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2588-316-0x0000000140000000-0x00000001401ED000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2588-670-0x0000000140000000-0x00000001401ED000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2616-702-0x0000000001D50000-0x0000000001DD8000-memory.dmp

                                            Filesize

                                            544KB

                                            Download

                                          • memory/2616-694-0x0000000001D50000-0x0000000001D5A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/2616-695-0x0000000001D50000-0x0000000001D6E000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/2616-696-0x0000000001D50000-0x0000000001D6A000-memory.dmp

                                            Filesize

                                            104KB

                                            Download

                                          • memory/2616-697-0x0000000001D50000-0x0000000001DDC000-memory.dmp

                                            Filesize

                                            560KB

                                            Download

                                          • memory/2616-698-0x0000000001D50000-0x0000000001DF4000-memory.dmp

                                            Filesize

                                            656KB

                                            Download

                                          • memory/2616-699-0x0000000001FE0000-0x000000000217E000-memory.dmp

                                            Filesize

                                            1.6MB

                                            Download

                                          • memory/2616-700-0x0000000001D50000-0x0000000001E3C000-memory.dmp

                                            Filesize

                                            944KB

                                            Download

                                          • memory/2616-701-0x0000000001D50000-0x0000000001D60000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2616-67-0x0000000000BB0000-0x0000000000C17000-memory.dmp

                                            Filesize

                                            412KB

                                            Download

                                          • memory/2616-703-0x0000000001D50000-0x0000000001D74000-memory.dmp

                                            Filesize

                                            144KB

                                            Download

                                          • memory/2616-704-0x0000000001D50000-0x0000000001D58000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2616-705-0x0000000001D50000-0x0000000001D7A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/2616-706-0x0000000001D50000-0x0000000001DB6000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/2616-254-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2616-72-0x0000000000BB0000-0x0000000000C17000-memory.dmp

                                            Filesize

                                            412KB

                                            Download

                                          • memory/2616-66-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2644-64-0x0000000010000000-0x00000000101E6000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2644-52-0x0000000010000000-0x00000000101E6000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2652-422-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2652-438-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2784-144-0x0000000140000000-0x00000001401DC000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2784-32-0x0000000140000000-0x00000001401DC000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2852-534-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2852-523-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2892-594-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2892-605-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2900-547-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2900-548-0x0000000003D70000-0x0000000003E2A000-memory.dmp

                                            Filesize

                                            744KB

                                            Download

                                          • memory/2900-552-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2944-582-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2944-570-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2972-86-0x0000000000470000-0x00000000004D0000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/2972-89-0x0000000140000000-0x00000001401ED000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/2972-80-0x0000000000470000-0x00000000004D0000-memory.dmp

                                            Filesize

                                            384KB

                                            Download

                                          • memory/3004-355-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download

                                          • memory/3004-293-0x0000000000400000-0x00000000005E7000-memory.dmp

                                            Filesize

                                            1.9MB

                                            Download