8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
Size

1.8MB
MD5

c164260da3db912f4c2958be242d9842
SHA1

8f96cd09836e235c48c623f7e04af69b60391341
SHA256

8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3
SHA512

dd9d53d134085ec143659f63b6c58d7b623ff5ee920e8c514ca5d352b067c808ef2dcedd6df6f7724992369ab97309f484abf42b84dc618381a26243dbd49b20
SSDEEP

49152:zKJ0WR7AFPyyiSruXKpk3WFDL9zxnSCisGcnlQHPxi:zKlBAFPydSS6W6X9lnLnlS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
480	Process not Found
2196	alg.exe
2716	aspnet_state.exe
3008	mscorsvw.exe
1660	mscorsvw.exe
1784	mscorsvw.exe
2272	mscorsvw.exe

Loads dropped DLL 2 IoCs

pid	Process
480	Process not Found
480	Process not Found

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4744631ce738cb9d.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ar.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_cs.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_fr.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_is.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_iw.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ms.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\psmachine_64.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\psuser_64.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ro.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_es-419.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ja.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\GoogleCrashHandler.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_fi.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_gu.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_pt-BR.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_te.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\GoogleUpdateComRegisterShell64.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_bg.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_et.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_fa.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_fil.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_sk.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_zh-CN.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_zh-TW.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdate.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_da.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_hu.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_id.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_vi.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\GoogleUpdate.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ca.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_am.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_es.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_lt.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_sv.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUTFBB.tmp	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\psuser.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\psmachine.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_uk.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ta.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ur.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\GoogleUpdateSetup.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_en-GB.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_sl.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_el.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_it.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ml.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_sw.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\GoogleCrashHandler64.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_bn.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ru.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\GoogleUpdateBroker.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_pt-PT.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_nl.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_th.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_en.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_ko.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_sr.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\GoogleUpdateCore.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_pl.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_hi.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_kn.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_lv.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Program Files (x86)\Google\Temp\GUMFBA.tmp\goopdateres_no.dll	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2044	8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe

C:\Users\Admin\AppData\Local\Temp\8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe
"C:\Users\Admin\AppData\Local\Temp\8266f332ab4224b65ee1f43ea788ff3d2e63eef3bb6ea22ed6cb1c2fd6f7ccb3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
PID:1104

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
PID:2576

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 1b8 -NGENProcess 1bc -Pipe 1c8 -Comment "NGen Worker Process"
  2⤵
  PID:568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 230 -NGENProcess 238 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:2500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 254 -NGENProcess 250 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 258 -NGENProcess 25c -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  PID:3064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  PID:1744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 260 -NGENProcess 250 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:1356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 268 -NGENProcess 1f0 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:2804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 24c -NGENProcess 270 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:1336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 25c -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 254 -NGENProcess 270 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 274 -NGENProcess 24c -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 23c -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  PID:1280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 278 -NGENProcess 274 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:1268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 248 -NGENProcess 274 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:1124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 278 -NGENProcess 27c -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 288 -NGENProcess 27c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 290 -NGENProcess 274 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:2104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 280 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 294 -NGENProcess 27c -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:2720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 268 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a4 -NGENProcess 27c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:2392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2a8 -NGENProcess 28c -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:1760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 220 -NGENProcess 250 -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  PID:1264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 1d8 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 264 -NGENProcess 270 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 220 -NGENProcess 244 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 250 -NGENProcess 270 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 270 -NGENProcess 240 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 244 -NGENProcess 1c4 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  PID:2348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 250 -NGENProcess 1d0 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  PID:2388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 240 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1f0 -NGENProcess 268 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 264 -NGENProcess 2b0 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2b0 -NGENProcess 1d0 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 244 -NGENProcess 280 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:1544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 268 -NGENProcess 29c -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  PID:812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 1d0 -NGENProcess 2ac -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 2ac -NGENProcess 280 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2a8 -NGENProcess 268 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:1580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2ac -NGENProcess 244 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 290 -NGENProcess 2b0 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2b0 -NGENProcess 2a8 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2b8 -NGENProcess 274 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 290 -NGENProcess 2bc -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 27c -NGENProcess 274 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 274 -NGENProcess 280 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2c8 -NGENProcess 2bc -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:1608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2bc -NGENProcess 27c -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:2240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 290 -NGENProcess 2d4 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 244 -NGENProcess 2d0 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2d0 -NGENProcess 1d0 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2b0 -NGENProcess 2e0 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2d4 -NGENProcess 2e4 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 27c -NGENProcess 2e0 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 274 -NGENProcess 2ec -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2b0 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:1044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2e0 -NGENProcess 2f4 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:1928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2d0 -NGENProcess 2f0 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2f8 -NGENProcess 2b0 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e0 -NGENProcess 300 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f4 -NGENProcess 304 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2b0 -NGENProcess 308 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:2156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 290 -NGENProcess 308 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:2632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 310 -NGENProcess 30c -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:2576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 304 -NGENProcess 314 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 314 -NGENProcess 300 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2f4 -NGENProcess 31c -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2b0 -NGENProcess 320 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2ec -NGENProcess 31c -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:1628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 328 -NGENProcess 2f4 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 2f8 -NGENProcess 314 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 2ec -NGENProcess 330 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 30c -NGENProcess 314 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 338 -NGENProcess 2f8 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 31c -NGENProcess 2f4 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 30c -NGENProcess 340 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2b0 -NGENProcess 2f4 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 348 -NGENProcess 31c -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 30c -NGENProcess 34c -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  PID:2372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 2f8 -NGENProcess 350 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 31c -NGENProcess 354 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 34c -NGENProcess 358 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 300 -NGENProcess 354 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 360 -NGENProcess 31c -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:1544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 34c -NGENProcess 364 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 2f8 -NGENProcess 368 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:1200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 36c -NGENProcess 364 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:2616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 370 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:1932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 34c -NGENProcess 364 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:1480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 364 -NGENProcess 34c -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 378 -NGENProcess 370 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 358 -NGENProcess 380 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 368 -NGENProcess 384 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:2904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 388 -NGENProcess 380 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 378 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 368 -NGENProcess 390 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 384 -NGENProcess 394 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 34c -NGENProcess 390 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:2060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 390 -NGENProcess 36c -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 398 -NGENProcess 3a4 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 3a4 -NGENProcess 38c -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 378 -NGENProcess 394 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 394 -NGENProcess 3ac -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b0 -NGENProcess 3a8 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b0 -NGENProcess 394 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 370 -NGENProcess 3bc -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 370 -NGENProcess 38c -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:1816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 3c0 -NGENProcess 3b8 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:1484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 378 -NGENProcess 370 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 384 -NGENProcess 3c8 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3a0 -NGENProcess 3cc -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 398 -NGENProcess 3c8 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 38c -NGENProcess 3d4 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 384 -NGENProcess 3d8 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3dc -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:1256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3e0 -NGENProcess 3d8 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:1452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 38c -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 3c8 -NGENProcess 3e8 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3ec -NGENProcess 38c -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 38c -NGENProcess 3dc -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  PID:1648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 38c -NGENProcess 3ec -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:1340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3e4 -NGENProcess 3dc -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3e4 -NGENProcess 38c -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:1772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3d4 -NGENProcess 408 -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:2388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3d4 -NGENProcess 38c -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:1044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 404 -NGENProcess 3c8 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 410 -NGENProcess 38c -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 38c -NGENProcess 3ec -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:1584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3d4 -NGENProcess 3c8 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:1608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 41c -NGENProcess 408 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 414 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3d4 -NGENProcess 424 -Pipe 41c -Comment "NGen Worker Process"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 428 -NGENProcess 414 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 3ec -NGENProcess 42c -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:2808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 420 -NGENProcess 414 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 404 -NGENProcess 434 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:1932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 424 -NGENProcess 414 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 438 -NGENProcess 420 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 43c -NGENProcess 434 -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 424 -NGENProcess 444 -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 404 -NGENProcess 448 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 43c -NGENProcess 448 -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 454 -NGENProcess 424 -Pipe 450 -Comment "NGen Worker Process"
  2⤵
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 45c -NGENProcess 434 -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  PID:1648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 43c -NGENProcess 460 -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:2784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 460 -NGENProcess 43c -Pipe 464 -Comment "NGen Worker Process"
  2⤵
  PID:1816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 434 -NGENProcess 46c -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:1932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 434 -NGENProcess 468 -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 424 -NGENProcess 46c -Pipe 448 -Comment "NGen Worker Process"
  2⤵
  PID:1288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 414 -NGENProcess 474 -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:1752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 470 -NGENProcess 478 -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  PID:2784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 478 -NGENProcess 46c -Pipe 474 -Comment "NGen Worker Process"
  2⤵
  PID:1256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 480 -NGENProcess 414 -Pipe 47c -Comment "NGen Worker Process"
  2⤵
  PID:864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 470 -NGENProcess 488 -Pipe 478 -Comment "NGen Worker Process"
  2⤵
  PID:2060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 468 -NGENProcess 414 -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4c4 -NGENProcess 4c8 -Pipe 4d0 -Comment "NGen Worker Process"
  2⤵
  PID:2348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4f0 -NGENProcess 4c4 -Pipe 4c0 -Comment "NGen Worker Process"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4e0 -NGENProcess 4cc -Pipe 4d8 -Comment "NGen Worker Process"
  2⤵
  PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4dc -NGENProcess 4f4 -Pipe 4f0 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4ec -NGENProcess 4f8 -Pipe 4e8 -Comment "NGen Worker Process"
  2⤵
  PID:1260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 4fc -NGENProcess 4f4 -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4c8 -NGENProcess 4e4 -Pipe 4ec -Comment "NGen Worker Process"
  2⤵
  PID:1664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4c4 -NGENProcess 4f4 -Pipe 4f8 -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 500 -NGENProcess 4fc -Pipe 1a8 -Comment "NGen Worker Process"
  2⤵
  PID:864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 508 -NGENProcess 4e4 -Pipe 504 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 50c -NGENProcess 4d4 -Pipe 4cc -Comment "NGen Worker Process"
  2⤵
  PID:2040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 50c -NGENProcess 508 -Pipe 4fc -Comment "NGen Worker Process"
  2⤵
  PID:2060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4c4 -NGENProcess 514 -Pipe 4f4 -Comment "NGen Worker Process"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 4e0 -NGENProcess 508 -Pipe 4e4 -Comment "NGen Worker Process"
  2⤵
  PID:1752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 51c -NGENProcess 50c -Pipe 518 -Comment "NGen Worker Process"
  2⤵
  PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 4c8 -NGENProcess 500 -Pipe 514 -Comment "NGen Worker Process"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 524 -NGENProcess 4d4 -Pipe 520 -Comment "NGen Worker Process"
  2⤵
  PID:784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 51c -NGENProcess 528 -Pipe 4c8 -Comment "NGen Worker Process"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 508 -NGENProcess 52c -Pipe 510 -Comment "NGen Worker Process"
  2⤵
  PID:700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4d4 -NGENProcess 530 -Pipe 50c -Comment "NGen Worker Process"
  2⤵
  PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 500 -NGENProcess 52c -Pipe 4c4 -Comment "NGen Worker Process"
  2⤵
  PID:2372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 538 -NGENProcess 508 -Pipe 534 -Comment "NGen Worker Process"
  2⤵
  PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 4d4 -NGENProcess 53c -Pipe 500 -Comment "NGen Worker Process"
  2⤵
  PID:2148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 51c -NGENProcess 540 -Pipe 524 -Comment "NGen Worker Process"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 508 -NGENProcess 544 -Pipe 530 -Comment "NGen Worker Process"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 548 -NGENProcess 540 -Pipe 52c -Comment "NGen Worker Process"
  2⤵
  PID:2168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 4e0 -NGENProcess 54c -Pipe 508 -Comment "NGen Worker Process"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 550 -NGENProcess 540 -Pipe 51c -Comment "NGen Worker Process"
  2⤵
  PID:1936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 528 -NGENProcess 554 -Pipe 4e0 -Comment "NGen Worker Process"
  2⤵
  PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 4dc -NGENProcess 558 -Pipe 538 -Comment "NGen Worker Process"
  2⤵
  PID:2156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 544 -NGENProcess 554 -Pipe 54c -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 55c -NGENProcess 528 -Pipe 53c -Comment "NGen Worker Process"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 4dc -NGENProcess 564 -Pipe 544 -Comment "NGen Worker Process"
  2⤵
  PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4d4 -NGENProcess 528 -Pipe 540 -Comment "NGen Worker Process"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 560 -NGENProcess 56c -Pipe 4dc -Comment "NGen Worker Process"
  2⤵
  PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 550 -NGENProcess 528 -Pipe 548 -Comment "NGen Worker Process"
  2⤵
  PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 570 -NGENProcess 4d4 -Pipe 554 -Comment "NGen Worker Process"
  2⤵
  PID:2332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 574 -NGENProcess 56c -Pipe 558 -Comment "NGen Worker Process"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 578 -NGENProcess 528 -Pipe 55c -Comment "NGen Worker Process"
  2⤵
  PID:928

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3008

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2196

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
PID:1556

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
PID:1648

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
PID:1500

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:2308

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:1192

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2396

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1852

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:1704

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:2460

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2100

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:2848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2592

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:2880

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
PID:2552

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2108

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1944

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1080

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
PID:580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:2136
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1124
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
  2⤵
  PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
4a79017740d46279bcad6d2c29dbb0be

SHA1
37846a0f499b44d8c7d96bb4c7282a7276bd22d3

SHA256
6662f2654aef6c8df2a4ffad6330f07b1b4b8fad5b453643094a841dbdfafee6

SHA512
e46cb91ae490d862dbc339dad7edf56baf6c481e12046b7a6a0d77aa462d83d6c777a79ef20d53af0aa8783aff6309f8beff71625b7a4be3ea565a93dedf0c47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
678KB

MD5
dce5b6a8e45c4dc14f269fe2993df180

SHA1
ef52ebc3a47241236de2e7adf7183724cbcb2499

SHA256
8aa8454dc4436e1e6b5dfc4e03075d4801d0f4a8d718aa9f9a8902fd6b3acff6

SHA512
8a7d23583f5f40545d2a6b6532e42b7ab3209d84f86c7d86615c90fd820a01c97d3135ed44e73c76f62f6e3de7f36a80621801f5fbcfdd87157453e1c9b4c751

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
656KB

MD5
d1cab9d8ecce9a08af22766ff940f36b

SHA1
d12f1e558223a937ca2ca22bfa032b6ce7cdf91a

SHA256
e01e525d864eadc340cfcdff6d776d73472a1b6e99d5acd47ae111691081f855

SHA512
e62d8fa62d7a9059e5175a85e22e092e90bd74e85fa799e0ccce91b055b039d775e4b014c2449592726f952baf30ca2d45e15519121ec735ce6e77b017479eb3

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
587KB

MD5
82e28fed2fe756188caf5ec46eb8fbcb

SHA1
31656ba9d594fc75fb7c7f99eeb25b73db3a0c82

SHA256
a343773cbd14cd2cab4341e658174973c1cd71f70a43e744427c336dc134167d

SHA512
8374f46fd40492979048a69b39e1afb8dd00b13a99b8e27d823f25d9211b6c0560856adfa6df16ee5a791fd4aa1c2bee5f84ce83782c9964d4cd1e10369d0139

Download Submit
C:\Windows\System32\Locator.exe

Filesize
577KB

MD5
4acc8c114562496c48aa5a3fe1e181d7

SHA1
d6d18a5758799ef18a473e538fcba44ab65d47d8

SHA256
81a427542269bb736e5057f45372e97165bd76d2da608fc72e726e28fb4a6f17

SHA512
6260c02641d1bcc66301d0d6d96746fb3f834bfea42487d6b7f6250a56d184c77bf073636339bb8d85773db6aeb7a87b1efeaccad7619b1054c0367240200087

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.1MB

MD5
b6a3c1bba4b400b177b998824027531b

SHA1
060dd4cbd1f9538e75889511c4b9500f5a9e2b44

SHA256
43620cf56c66a01f0b781fd978958dd0949496ab728891491dc5d71c3c635077

SHA512
a38d92b7c4479c043c1c7ebff1eec1986aeb493fc627de2e5e5afb2ce85a162909b9693496525664c5b4497f82047507106fc380dec5f7e616424d738474ceb9

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll

Filesize
158KB

MD5
a763a9348ab4ee3bd593bb17d854e51b

SHA1
4d0c97ba6877e2f9ab32fe1316936a4f2e0ff2c9

SHA256
b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b

SHA512
e8d3896d4bd788d3ed923e0c9d3ba19fe9fc507060e2e5e8e410964f4c9d7331928324a79336079ccc84c050d8f0acfb03126a2e3622daac3846b0bfd028f602

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll

Filesize
296KB

MD5
7687295a6e19cc656b077e6a61629d4e

SHA1
fa1025de5cffb56a3d1f8cae9d09b7171b33326e

SHA256
ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86

SHA512
19de95fd90bc6f091e785074ee71dc15d450d65fbdea933e26650fb9c747d81ae2fca7f5f83192f17451a49a314d264cabea2202c805b6ffab729d381675734c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Filesize
92KB

MD5
469abbe1bcb3c95d8504299ef7a15596

SHA1
74a81ce4aa7b0659d557f43af8a6aec920f485f9

SHA256
c66410579ce7d9bc3e518bbd422565478b708f63454ac8bbc7f6fd908f7c0d58

SHA512
2e5cc8b55f6c9df0fdebad7b574d8e346ccd26cac0329c911ad9f4d97906aa32d6612f2e7fcbb32ab67395e4f4bd6acea0a03e4d1bbfd5f030a05cd62c05d095

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll

Filesize
92KB

MD5
858ba637b1c7c7cff3bcaf569ba98b5c

SHA1
db067a152acc163b19adc0eefbf3dd31a743ff2c

SHA256
3b91a535bcfb9d24287dbe52115f33266fe6407f50ddbf977bf287cc3104c2d1

SHA512
877ea858b195aa5c12a7f7177b9b54559a264c17194e8a5d1f9eb81add6fe685be219b0a41849accf08914e1ff3e8708fe023432635c4275dfe64dfd7ee85a2c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll

Filesize
172KB

MD5
af9dc1803637320c4decdbe860b72da9

SHA1
ec1a2520d065760f7c9f28cc38231f765fba7746

SHA256
562985a45f03d3c703a9c99f7fcc9ca6529698cac9b272fb4d0d2432113a3358

SHA512
3ddf7e8c674ff2ab5abc332dea9702a9be1f9eee0a89a905ad62136c887f07f4f7ab2c534f3890837891a5af3612fcd77381638f3d7982e5e59e270bdcd5a290

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Filesize
92KB

MD5
70e9e797bd25745f941fb3e690040106

SHA1
1dec24858a6c3fd1a82bcf370e4865ee5dc5febc

SHA256
ba4303625c61adf0815ca102fb62aab5b21f57c5a55f582d3348e1bbb150339c

SHA512
c3c982f9ab20e152355e3b053d0b58be17d8e401c054b02e08195a6919af04f55ad747fa9b17d2decc1599f5bf088e7406ef5685504ef993d97949afcd46adfc

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll

Filesize
381KB

MD5
cea747f2a5a68ee03b0c77942cc45394

SHA1
85ac7395fdc73fd73c8a8acd0dd0d43bb3581035

SHA256
439661afee9ff86f8933240f23070bf4656e71976e3ec095056a6abf96c35706

SHA512
88c07890b85e9c1139b8e85b0bc03774abdb5d123693a31c232b8ebb9f3a34a58c44f31a7bd7b9a8f58ef700f357cf24086b6eeee1a8d66ae483cbf2088ce302

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Filesize
32KB

MD5
517d9208457db817783c38cdb50626bf

SHA1
890b8c9ed3c5ba7b4fe0d5ae9274c21d0ac97dd5

SHA256
7b16d8a850877ba1b1355cb863a8b163d7671cd23e7b91822ee69750fb79b81d

SHA512
b1669238b2336fba764ed255550222b9e06242ef525d42edbf87505d89aae3bc3d7169b4ed828c2d4751ab544d1b6f1227fe6a10ccacc5d4c2bf6c57568282cc

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll

Filesize
92KB

MD5
047f08728e39f36ac7a8199c39cb3195

SHA1
2fb71cbb7b334f7757dc90fac032c63891a584ac

SHA256
8a1dbacdeaf47871025ca064e3e8757584f30c8c7bc032215208730c224d8ed2

SHA512
0c121071d974511f113ffe24497d5dd47bb234c627bbabb7fabe261a57bfb237e8dd668a7a0301b83eb13af55469c20a398e3dcc0bd88488d4cea46ea944e975

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll

Filesize
141KB

MD5
58cacef7cbc000bb5ddeedc08a598f36

SHA1
f8963d4ac1f7b72c2ee4a0a6d45b921f4f88bab7

SHA256
124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270

SHA512
9cf04e365abcdcfcb9c1f927da83a2dfe0791cccb80cd84ed63b03264d1e253060c455ed8664f35aee0a59e8c172f859ba49c67c9eec811a53e656c076c6bf66

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Filesize
32KB

MD5
c9e0323da67c28257f858c4100727ec0

SHA1
72afe50414f609df03f3a775d5926fb70b5f956e

SHA256
bb453de5c8b75715d9e0556fc02e9e0d3dfbc313335a4ac0b4a009acfbbbfdc4

SHA512
bd4b4dc1ef045b89556df3a95cb026bbf89a95a48de376bea6bea6e01fb8986159cbbe8888837db5b6362714ce092eb94a57d1821c90f693da432ccebfbec2e9

Download Submit
memory/1104-194-0x0000000140000000-0x00000001400B2000-memory.dmp

Filesize
712KB

Download
memory/1104-202-0x00000000003C0000-0x0000000000420000-memory.dmp

Filesize
384KB

Download
memory/1104-284-0x0000000140000000-0x00000001400B2000-memory.dmp

Filesize
712KB

Download
memory/1192-331-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/1192-372-0x00000000741F8000-0x000000007420D000-memory.dmp

Filesize
84KB

Download
memory/1192-333-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1192-326-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1500-251-0x0000000000510000-0x0000000000576000-memory.dmp

Filesize
408KB

Download
memory/1500-257-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1500-319-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1648-312-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/1648-224-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/1648-230-0x0000000000160000-0x00000000001C0000-memory.dmp

Filesize
384KB

Download
memory/1660-174-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/1660-122-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/1660-129-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/1660-123-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/1744-371-0x0000000072DF0000-0x00000000734DE000-memory.dmp

Filesize
6.9MB

Download
memory/1744-351-0x0000000000280000-0x00000000002E6000-memory.dmp

Filesize
408KB

Download
memory/1784-222-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1784-146-0x0000000000230000-0x0000000000296000-memory.dmp

Filesize
408KB

Download
memory/1784-141-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1784-140-0x0000000000230000-0x0000000000296000-memory.dmp

Filesize
408KB

Download
memory/1796-298-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1796-208-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1796-216-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/2044-6-0x0000000001E60000-0x0000000001EC6000-memory.dmp

Filesize
408KB

Download
memory/2044-1-0x0000000001E60000-0x0000000001EC6000-memory.dmp

Filesize
408KB

Download
memory/2044-139-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2044-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2100-380-0x0000000000450000-0x00000000004B0000-memory.dmp

Filesize
384KB

Download
memory/2100-378-0x0000000100000000-0x0000000100095000-memory.dmp

Filesize
596KB

Download
memory/2196-12-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/2196-158-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/2196-43-0x00000000008C0000-0x0000000000920000-memory.dmp

Filesize
384KB

Download
memory/2196-13-0x00000000008C0000-0x0000000000920000-memory.dmp

Filesize
384KB

Download
memory/2272-232-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/2272-160-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/2272-165-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/2308-265-0x0000000000FA0000-0x0000000001000000-memory.dmp

Filesize
384KB

Download
memory/2308-253-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/2308-279-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/2308-278-0x0000000000FA0000-0x0000000001000000-memory.dmp

Filesize
384KB

Download
memory/2396-342-0x0000000001000000-0x0000000001096000-memory.dmp

Filesize
600KB

Download
memory/2396-355-0x00000000001A0000-0x0000000000206000-memory.dmp

Filesize
408KB

Download
memory/2460-374-0x0000000100000000-0x0000000100096000-memory.dmp

Filesize
600KB

Download
memory/2552-269-0x0000000000D90000-0x0000000000E10000-memory.dmp

Filesize
512KB

Download
memory/2552-324-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-329-0x0000000000D90000-0x0000000000E10000-memory.dmp

Filesize
512KB

Download
memory/2552-338-0x0000000000D90000-0x0000000000E10000-memory.dmp

Filesize
512KB

Download
memory/2552-244-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-249-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-246-0x0000000000D90000-0x0000000000E10000-memory.dmp

Filesize
512KB

Download
memory/2576-203-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/2576-262-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2576-185-0x00000000003C0000-0x0000000000420000-memory.dmp

Filesize
384KB

Download
memory/2576-182-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2576-177-0x00000000003C0000-0x0000000000420000-memory.dmp

Filesize
384KB

Download
memory/2592-300-0x00000000002D0000-0x0000000000330000-memory.dmp

Filesize
384KB

Download
memory/2592-353-0x0000000000600000-0x00000000006B2000-memory.dmp

Filesize
712KB

Download
memory/2592-347-0x0000000100000000-0x00000001000B2000-memory.dmp

Filesize
712KB

Download
memory/2592-290-0x0000000000600000-0x00000000006B2000-memory.dmp

Filesize
712KB

Download
memory/2592-287-0x0000000100000000-0x00000001000B2000-memory.dmp

Filesize
712KB

Download
memory/2716-180-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/2716-93-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/2716-102-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Filesize
384KB

Download
memory/2716-94-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Filesize
384KB

Download
memory/2716-100-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Filesize
384KB

Download
memory/2848-322-0x0000000000230000-0x0000000000296000-memory.dmp

Filesize
408KB

Download
memory/2848-305-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2848-377-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2880-274-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2880-267-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/2880-336-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/3008-155-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/3008-105-0x0000000000460000-0x00000000004C6000-memory.dmp

Filesize
408KB

Download
memory/3008-112-0x0000000000460000-0x00000000004C6000-memory.dmp

Filesize
408KB

Download
memory/3008-106-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download