8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db

Analysis

max time kernel
1s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
Size

1.8MB
MD5

0f755611f46a8c95abf839fc096fab6d
SHA1

6e5671c63cfc538718c6ddc4390730d81f83cd31
SHA256

8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db
SHA512

17ca3184c6dee6590d922310dacf3bb79633af1fcd9fcff5f821400f403f462aff0346fc070d9f7089aa0d85b78828a6ab6dad5acc71cfaf0ca7b1af82031fe5
SSDEEP

49152:Hx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAGgDUYmvFur31yAipQCtXxc0H:HvbjVkjjCAzJ0U7dG1yfpVBlH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
480	Process not Found
1228	alg.exe
1720	aspnet_state.exe
2920	mscorsvw.exe
1044	mscorsvw.exe
1436	mscorsvw.exe
2300	mscorsvw.exe
1996	ehRecvr.exe

Loads dropped DLL 3 IoCs

pid	Process
480	Process not Found
480	Process not Found
480	Process not Found

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f8c2f758e738cb9d.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_is.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_sw.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_en-GB.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_ja.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_lt.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_lv.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\psuser_64.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleCrashHandler64.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_uk.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleUpdateSetup.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_fil.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_sr.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_es.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_no.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_id.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_pl.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_sk.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleUpdateCore.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_gu.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_th.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_it.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_iw.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_es-419.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_fr.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_ms.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_pt-BR.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_te.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_ur.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_cs.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_da.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_ml.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\psmachine.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_hi.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_sv.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_bn.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_ca.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_el.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_kn.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_mr.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleUpdateSetup.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\psmachine_64.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_bg.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_et.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_ko.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_sl.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_zh-CN.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleUpdate.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdate.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleUpdateComRegisterShell64.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_am.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_pt-PT.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleUpdateBroker.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleUpdateOnDemand.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_en.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_fa.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\psuser.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_ar.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_hr.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_nl.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUTA10.tmp	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\GoogleCrashHandler.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_tr.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_zh-TW.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA0F.tmp\goopdateres_hu.dll	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1736	8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
Token: SeShutdownPrivilege	1436	mscorsvw.exe
Token: SeShutdownPrivilege	2300	mscorsvw.exe

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
PID:568

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2300
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 238 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 20c -NGENProcess 1e4 -Pipe 1b0 -Comment "NGen Worker Process"
  2⤵
  PID:2972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 254 -NGENProcess 1dc -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:1800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 25c -NGENProcess 228 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 20c -NGENProcess 260 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:2264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 248 -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:1816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 264 -NGENProcess 228 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:1688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 26c -NGENProcess 248 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  PID:2704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1c4 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:2264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 27c -NGENProcess 20c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 284 -NGENProcess 27c -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 228 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:1148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1bc -NGENProcess 288 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 280 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:2628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 270 -NGENProcess 290 -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  PID:2248
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 294 -NGENProcess 28c -Pipe 210 -Comment "NGen Worker Process"
  2⤵
  PID:952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 28c -NGENProcess 260 -Pipe 1bc -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 29c -NGENProcess 290 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:2076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 27c -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  PID:2656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 1c4 -NGENProcess 29c -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 28c -NGENProcess 2a8 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 260 -NGENProcess 2b0 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 1c4 -Comment "NGen Worker Process"
  2⤵
  PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 290 -NGENProcess 2b8 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:2796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2bc -NGENProcess 29c -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  PID:2932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 29c -NGENProcess 294 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  PID:692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 290 -NGENProcess 2c4 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:2248
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2c4 -NGENProcess 270 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2d0 -NGENProcess 2a8 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:1508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2a8 -NGENProcess 290 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:2180
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2a8 -NGENProcess 2d0 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2b0 -NGENProcess 2e0 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:2128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2c0 -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:1492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2e8 -NGENProcess 2e4 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2e4 -NGENProcess 2b0 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:1136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2d0 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:2796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 270 -NGENProcess 2f4 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:1012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2d4 -NGENProcess 2f0 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:2684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f8 -NGENProcess 2d0 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:2272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 270 -NGENProcess 2fc -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:2764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2f4 -NGENProcess 300 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  PID:768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 300 -NGENProcess 2d0 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:2012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 270 -NGENProcess 2f8 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2f8 -NGENProcess 2f4 -Pipe 108 -Comment "NGen Worker Process"
  2⤵
  PID:676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 30c -NGENProcess 2d0 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 270 -NGENProcess 310 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 10c -NGENProcess 314 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 10c -InterruptEvent 2d8 -NGENProcess 310 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:2180
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f0 -NGENProcess 318 -Pipe 10c -Comment "NGen Worker Process"
  2⤵
  PID:700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 31c -NGENProcess 310 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 304 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 318 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:1432
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 310 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 304 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:3016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 324 -NGENProcess 330 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:1852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 2f0 -NGENProcess 304 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 300 -NGENProcess 338 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 33c -NGENProcess 304 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 310 -NGENProcess 340 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 32c -NGENProcess 344 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:2076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 304 -NGENProcess 348 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:1336
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 338 -NGENProcess 344 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 31c -NGENProcess 350 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 32c -NGENProcess 354 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 344 -NGENProcess 358 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:1852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 350 -NGENProcess 35c -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 354 -NGENProcess 360 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 360 -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 338 -NGENProcess 36c -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 338 -NGENProcess 368 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 340 -NGENProcess 374 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 36c -NGENProcess 378 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 37c -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:1560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 374 -NGENProcess 380 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 348 -NGENProcess 37c -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 370 -NGENProcess 338 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:2804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 344 -NGENProcess 388 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 38c -NGENProcess 338 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 37c -NGENProcess 390 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 348 -NGENProcess 394 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:2272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 398 -NGENProcess 390 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 370 -NGENProcess 39c -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 3a0 -NGENProcess 390 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:1356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 388 -NGENProcess 3a4 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 368 -NGENProcess 3a8 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 394 -NGENProcess 3a4 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:1980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 398 -NGENProcess 3b0 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 388 -NGENProcess 3b4 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3a4 -NGENProcess 3b8 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3b0 -NGENProcess 3bc -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3b4 -NGENProcess 3c0 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b8 -NGENProcess 3c4 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:2544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 3bc -NGENProcess 3c8 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3cc -NGENProcess 3c4 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 398 -NGENProcess 3d0 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 3d4 -NGENProcess 3c4 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:1976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3a4 -NGENProcess 3d8 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 390 -NGENProcess 3dc -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:1124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3c4 -NGENProcess 3e0 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d8 -NGENProcess 3e4 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e8 -NGENProcess 3d8 -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  PID:2632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  PID:992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 244 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 248 -NGENProcess 240 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:2144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 1f0 -NGENProcess 254 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:2364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1d8 -NGENProcess 240 -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 234 -NGENProcess 25c -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  PID:3060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 1e8 -NGENProcess 240 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  PID:2628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 260 -NGENProcess 1d8 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 234 -NGENProcess 268 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  PID:780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 24c -NGENProcess 1d8 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:2392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 264 -NGENProcess 270 -Pipe 234 -Comment "NGen Worker Process"
  2⤵
  PID:2352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1d8 -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 1d8 -NGENProcess 270 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 278 -NGENProcess 26c -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:1288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 270 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:3060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 278 -NGENProcess 290 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:2356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 274 -NGENProcess 26c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 270 -NGENProcess 298 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:1296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 27c -NGENProcess 2a0 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:2124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2a4 -NGENProcess 26c -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:2928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 29c -NGENProcess 2ac -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2268

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1044

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2920

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1228

C:\Users\Admin\AppData\Local\Temp\8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe
"C:\Users\Admin\AppData\Local\Temp\8802745903a6085878f672137c56e1eb7599c280ee07bd1def069ef7391112db.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
PID:2828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:2868

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:1544

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:2576

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
PID:2732

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
PID:1252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:1940

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2996

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1536

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1648

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2288

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:2720

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1748

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
PID:1584

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:780

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
PID:1796

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:2516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:2772
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
  2⤵
  PID:2880
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
d01341e6f06714422dca5d0157a6ca4b

SHA1
315fa39c946cf62227a950fb60a0b08125270b66

SHA256
514cbcd2e5fb361a201d81f5484843a3012f813b955e354a7f446ceff74fd16f

SHA512
ebf771c62952ace269714f547a0c0365dd5cc020d534870ad12d7295187d810dd192cfbdacf4de1f00960567448a46a0286e66a69da6fad1db65ee902cdbf185

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
587KB

MD5
1e3d7a0a47227b7dc7e78967f112657d

SHA1
a8ce103e1fcc552d463a8087cf74e94d06a01b54

SHA256
bf3321a1c5e8948cf66853e35e5e40561ae0b51d33a1756dab3e35944e835be7

SHA512
d4026a7218491b63f7be444d1a417e0ad4677eb78b7f62b6712a196832e82d324bacf7b3629524580206e8a43b461383496d998c6743e86671b0979be2edf78b

Download Submit
C:\Windows\System32\Locator.exe

Filesize
577KB

MD5
6d27e187c5c57c1d9dcf3defd6ca84b0

SHA1
4e61a0aaf1622d372366028d70c3eb0be0759f40

SHA256
b72c15ca62b131178fcea5a94ffcf4502647a64291419f67a11448fcb660fea1

SHA512
b95e4f022d25681e38e7d63e9752721355648bf4df6b62298f264520bea164a0c64696c51f47ebc9827a2b2de44be9f2f0b3036858880d6bb7b9b462f0d4590c

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
705KB

MD5
a2d01dba8430dc7835efac6b89828393

SHA1
74f5b142e14e61a31d0c10cf93b32b10cada2784

SHA256
a1afd90624ead196bca2614f154d43ab4ab483ae22bbd27d7b4db4bd9e9b60f8

SHA512
1629ff5e5edd0713c8cd5f713619fb0faa38c708d9f5d93c84e15be8bcd6f4400b456c3785603a7eca82218d15ea9f0650174764eabd9375f275d34c971f8dbf

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
691KB

MD5
1a77d0d72ff8a02d056cfca609e58773

SHA1
3f4a3f64fbd3b6635d639b5482aebd49d1c3f506

SHA256
9768ef033b953f7655797a68cdcdcdaef1cb3ccbb9cb20afb20c399cd094f31a

SHA512
e196f482732a2f64627d2d817df83ce309681ff88e5fb62f9c3fc94b33e477b663872f28fa21fdff4c8f4d854dcd6ecd85cfa07b3bcffb476a3afb7b0535051c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
memory/452-560-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/452-556-0x0000000000AE0000-0x0000000000B40000-memory.dmp

Filesize
384KB

Download
memory/452-558-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/452-568-0x0000000000AE0000-0x0000000000B40000-memory.dmp

Filesize
384KB

Download
memory/452-564-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/564-555-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/564-541-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/564-554-0x0000000000460000-0x00000000004C0000-memory.dmp

Filesize
384KB

Download
memory/564-553-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/564-540-0x0000000000460000-0x00000000004C0000-memory.dmp

Filesize
384KB

Download
memory/568-275-0x00000000002B0000-0x0000000000310000-memory.dmp

Filesize
384KB

Download
memory/568-326-0x0000000140000000-0x00000001400B2000-memory.dmp

Filesize
712KB

Download
memory/568-197-0x0000000140000000-0x00000001400B2000-memory.dmp

Filesize
712KB

Download
memory/992-565-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/992-574-0x0000000000390000-0x00000000003F7000-memory.dmp

Filesize
412KB

Download
memory/1044-126-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/1044-130-0x0000000000240000-0x00000000002A0000-memory.dmp

Filesize
384KB

Download
memory/1044-123-0x0000000000240000-0x00000000002A0000-memory.dmp

Filesize
384KB

Download
memory/1044-160-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/1228-12-0x00000000002A0000-0x0000000000300000-memory.dmp

Filesize
384KB

Download
memory/1228-38-0x00000000002A0000-0x0000000000300000-memory.dmp

Filesize
384KB

Download
memory/1228-14-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/1228-167-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/1436-145-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1436-144-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Filesize
412KB

Download
memory/1436-289-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1436-150-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Filesize
412KB

Download
memory/1544-537-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1544-351-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/1544-380-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1544-482-0x00000000745A8000-0x00000000745BD000-memory.dmp

Filesize
84KB

Download
memory/1544-341-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1720-102-0x0000000000AA0000-0x0000000000B00000-memory.dmp

Filesize
384KB

Download
memory/1720-95-0x0000000000AA0000-0x0000000000B00000-memory.dmp

Filesize
384KB

Download
memory/1720-94-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/1720-179-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/1736-6-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/1736-1-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/1736-0-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/1736-143-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/1736-276-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/1996-339-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/1996-180-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Filesize
384KB

Download
memory/1996-181-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1996-187-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Filesize
384KB

Download
memory/1996-277-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/1996-312-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2300-170-0x00000000003F0000-0x0000000000450000-memory.dmp

Filesize
384KB

Download
memory/2300-301-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/2300-162-0x00000000003F0000-0x0000000000450000-memory.dmp

Filesize
384KB

Download
memory/2300-169-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/2576-523-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2576-328-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2576-335-0x0000000000510000-0x0000000000577000-memory.dmp

Filesize
412KB

Download
memory/2732-308-0x000007FEF4950000-0x000007FEF52ED000-memory.dmp

Filesize
9.6MB

Download
memory/2732-345-0x0000000000E20000-0x0000000000EA0000-memory.dmp

Filesize
512KB

Download
memory/2732-536-0x000007FEF4950000-0x000007FEF52ED000-memory.dmp

Filesize
9.6MB

Download
memory/2732-524-0x0000000000E20000-0x0000000000EA0000-memory.dmp

Filesize
512KB

Download
memory/2732-310-0x000007FEF4950000-0x000007FEF52ED000-memory.dmp

Filesize
9.6MB

Download
memory/2732-369-0x0000000000E20000-0x0000000000EA0000-memory.dmp

Filesize
512KB

Download
memory/2732-448-0x000007FEF4950000-0x000007FEF52ED000-memory.dmp

Filesize
9.6MB

Download
memory/2732-303-0x0000000000E20000-0x0000000000EA0000-memory.dmp

Filesize
512KB

Download
memory/2732-383-0x000007FEF4950000-0x000007FEF52ED000-memory.dmp

Filesize
9.6MB

Download
memory/2828-296-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2828-362-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2828-302-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Filesize
412KB

Download
memory/2868-324-0x00000000009B0000-0x0000000000A10000-memory.dmp

Filesize
384KB

Download
memory/2868-314-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/2868-318-0x00000000009B0000-0x0000000000A10000-memory.dmp

Filesize
384KB

Download
memory/2868-323-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/2888-343-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2888-281-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2888-290-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/2920-141-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2920-107-0x00000000009F0000-0x0000000000A57000-memory.dmp

Filesize
412KB

Download
memory/2920-106-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2920-113-0x00000000009F0000-0x0000000000A57000-memory.dmp

Filesize
412KB

Download